Which versions of PROMOD V are affected by CVE-2026-10763?

Hitachi Energy PROMOD V transmits grid-computing communications to Digipede servers in cleartext HTTP, exposing operational data to network-based interception and eavesdropping.

How to fix or mitigate CVE-2026-10763?

Within 24 hours: Inventory all Hitachi Energy PROMOD V installations and determine which communicate with Digipede servers over untrusted network segments; assess data classification of communications. Within 7 days: Implement network segmentation to isolate PROMOD-Digipede traffic; contact Hitachi Energy for patch timeline and official mitigation guidance; establish monitoring on affected communication paths. Within 30 days: Deploy compensating controls listed below; evaluate alternative grid-computing platforms if no patch timeline is provided; document residual risk acceptance for business stakeholders.

PROMOD V CVE-2026-10763

Q: What is the CVSS score of CVE-2026-10763?

CVE-2026-10763 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40275 HIGH

Reliance on HTTP instead of HTTPS (CWE-1428)

2026-06-30 Hitachi Energy

GHSA-jm8g-r6p8-h3xf

Information Disclosure Promod V Hitachi Energy

7.0

CVSS 4.0 · Vendor: Hitachi Energy

Severity by source

Vendor (Hitachi Energy) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Cleartext channel requires a MITM/interception position (AC:H) and a user-initiated simulation (UI:R); high confidentiality exposure with only limited in-transit tampering (I:L) and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Hitachi Energy).

CVSS VectorVendor: Hitachi Energy

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 10:22 vuln.today

DescriptionCVE.org

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server.

AnalysisAI

Cleartext-transmission exposure in Hitachi Energy PROMOD V allows a network man-in-the-middle to intercept or read sensitive data because the application relies on unencrypted HTTP rather than HTTPS when communicating with a third-party Digipede grid-computing server. The flaw (CWE-1428, reliance on an insecure communications channel) carries a CVSS 4.0 base score of 7.0 and is rated high confidentiality impact with limited integrity impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

PROMOD V is Hitachi Energy's production-cost and electricity-market simulation platform used by utilities, ISO/RTOs, and energy-market analysts for transmission and generation modeling. To accelerate large simulations it offloads compute to a Digipede distributed-computing grid; the affected component is this PROMOD-to-Digipede server channel, which transmits data over plain HTTP. The single listed CPE is cpe:2.3:a:hitachi_energy:promod_v:*:*:*:*:*:*:*:*. The root cause is CWE-1428 (Reliance on Insecure Internal Communications Channel) - sensitive information traverses the network without TLS, so anyone able to observe the traffic path can read it and potentially tamper with it. This is a transport-layer/configuration weakness in the third-party Digipede integration rather than a memory-safety or injection bug.

RemediationAI

No vendor-released patched version was identified in the available data - consult the Hitachi Energy advisory (https://publisher.hitachienergy.com/preview?DocumentID=8DBD000250) for the authoritative fixed release and apply it once published. As compensating controls until then: isolate PROMOD V and its Digipede server onto a dedicated, trusted network segment so the HTTP traffic never traverses untrusted links (trade-off: requires network re-architecture and may complicate distributed compute across sites); tunnel the PROMOD-to-Digipede communication through an encrypted transport such as an IPsec or TLS VPN/stunnel wrapper to provide confidentiality the application itself lacks (trade-off: added latency and operational overhead on compute jobs); and if the Digipede grid-computing feature is not required, disable it to eliminate the cleartext channel entirely (trade-off: loss of distributed-simulation performance). Restrict and monitor access to the network path to detect interception attempts.