Executive Summary
In June 2026, Hitachi Energy disclosed a vulnerability (CVE-2026-10763) in its PROMOD V software, which utilized unencrypted HTTP communication due to the lack of HTTPS support from a third-party Digipede server. This flaw exposed sensitive data to potential interception and manipulation, posing risks such as credential theft and unauthorized access. The affected versions include PROMOD V up to 1.0.10. (nvd.nist.gov)
This incident underscores the critical importance of secure communication protocols in industrial control systems. Organizations are urged to review their software dependencies and ensure that all components support encrypted communications to mitigate similar vulnerabilities.
Why This Matters Now
The reliance on unencrypted communication channels in critical infrastructure software highlights ongoing security challenges. As cyber threats evolve, ensuring end-to-end encryption becomes imperative to protect sensitive data and maintain system integrity.
Attack Path Analysis
An attacker intercepts unencrypted HTTP traffic between PROMOD V and the Digipede server, capturing sensitive data. Using the intercepted data, the attacker gains unauthorized access to PROMOD V. The attacker moves laterally within the network to access other systems. Establishing a command and control channel, the attacker maintains persistent access. Sensitive data is exfiltrated from the compromised systems. The attacker disrupts operations by manipulating or deleting critical data.
Kill Chain Progression
Initial Compromise
Description
An attacker intercepts unencrypted HTTP traffic between PROMOD V and the Digipede server, capturing sensitive data.
Related CVEs
CVE-2026-10763
CVSS 7PROMOD V uses insecure HTTP communication instead of HTTPS, due to lack of HTTPS support from the third-party Digipede server.
Affected Products:
Hitachi Energy PROMOD V – <=1.0.10
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Application Layer Protocol: Web Protocols
Network Sniffing
Man-in-the-Middle
Application Layer Protocol
Fallback Channels
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Use Strong Cryptography and Security Protocols to Protect Sensitive Data During Transmission
Control ID: 4.1
NYDFS 23 NYCRR 500 – Encryption of Nonpublic Information
Control ID: 500.15
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – Data Protection
Control ID: Pillar 3: Data
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Oil/Energy/Solar/Greentech
Critical vulnerability in Hitachi Energy PROMOD V power system modeling software exposes energy infrastructure to credential theft and unauthorized access via unencrypted HTTP communications.
Utilities
Electric utilities using PROMOD V face high risk of session hijacking and data interception affecting power grid planning and operational security systems.
Computer Software/Engineering
Software engineering firms developing or integrating energy management solutions must address insecure HTTP transmission vulnerabilities and implement HTTPS encryption protocols immediately.
Government Administration
Government energy agencies relying on PROMOD V for critical infrastructure planning face potential data manipulation risks requiring immediate upgrade to version 1.0.11.
Sources
- Hitachi Energy PROMOD Vhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-188-02Verified
- NVD - CVE-2026-10763https://nvd.nist.gov/vuln/detail/CVE-2026-10763Verified
- Hitachi Energy Cybersecurity Advisoryhttps://publisher.hitachienergy.com/preview?DocumentID=8DBD000250&LanguageCode=en&DocumentPartId=&Action=LaunchVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF would likely reduce the attacker's ability to intercept unencrypted traffic and limit lateral movement within the network, thereby constraining the overall impact of the incident.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Implementing Aviatrix Zero Trust CNSF would likely limit the attacker's ability to intercept unencrypted traffic between PROMOD V and the Digipede server.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation would likely constrain the attacker's ability to escalate privileges by limiting access to critical systems.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security would likely limit the attacker's ability to move laterally within the network.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control would likely constrain the attacker's ability to establish and maintain command and control channels.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit the attacker's ability to exfiltrate sensitive data from compromised systems.
Aviatrix Zero Trust CNSF would likely reduce the attacker's ability to disrupt operations by limiting access to critical data and systems.
Impact at a Glance
Affected Business Functions
- Energy Market Simulation
- Transmission Planning
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of sensitive data in transit, including credentials and session information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Encrypted Traffic (HPE) to secure data in transit and prevent interception.
- • Deploy Zero Trust Segmentation to enforce least privilege access and limit lateral movement.
- • Utilize East-West Traffic Security to monitor and control internal network communications.
- • Establish Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration.
- • Enhance Threat Detection & Anomaly Response capabilities to identify and respond to suspicious activities promptly.
