PROMOD V CVE-2026-10763

Exploitation requires the PROMOD V deployment to use the third-party Digipede server for distributed computation, since that is the channel transmitted over HTTP instead of HTTPS, and it requires a user to actively initiate the communication (UI:A) - a simulation run that triggers the PROMOD-to-Digipede exchange. The decisive limiting factor is that the attacker must hold a man-in-the-middle or traffic-observation position on the network path between PROMOD V and the Digipede server; the flaw is not exploitable without such interception access, which constrains it to adversaries already on the relevant network segment rather than arbitrary remote attackers. No authentication is needed once that position is held (PR:N).

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N) describes an unauthenticated, network-reachable issue with high confidentiality but only low integrity impact and no availability impact, requiring active user interaction (a user must run a simulation that triggers the Digipede communication). The realistic risk is materially lower than the 7.0 score suggests for most deployments: exploitation requires the attacker to already occupy a privileged position on the network path between PROMOD V and the Digipede server (a classic man-in-the-middle precondition), which is not reflected in the AC:L/AV:N rating - in practice an interception capability raises attack complexity. No EPSS score, KEV listing, or POC was provided, so there is no signal of opportunistic or automated exploitation; this is best treated as a targeted-eavesdropping risk against energy-sector operators on untrusted or shared network segments rather than a broadly weaponizable internet-facing flaw. The confidentiality-heavy impact aligns with the 'Information Disclosure' tag.

An attacker positioned on the local network or upstream path between a PROMOD V workstation and the Digipede server (e.g., via ARP spoofing on a shared LAN or a compromised switch) passively captures the unencrypted HTTP traffic when an analyst launches a distributed simulation, recovering sensitive model or operational data. With a MITM foothold the attacker could also alter low-impact in-transit content. No public proof-of-concept is required beyond standard packet-capture/MITM tooling.