Quick answers
- Is CVE-2026-10763 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-10763 being exploited in the wild.
- How severe is CVE-2026-10763?
- Informational severity, with a CVSS score of 7, published 30 June 2026.
- Which products and versions are affected?
- Hitachi Energy PROMOD V 1.0.0 to 1.0.10.
- Is there a fix for CVE-2026-10763?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-10763 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-10763?
- Check whether you run Hitachi Energy PROMOD V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
PROMOD V (versions 1.0.0 through 1.0.10) fails to utilize TLS encryption for communications with the integrated 3rd party Digipede server component. This vulnerability is classified as a failure to use a secure communication channel (CWE-319). An attacker with network access between the PROMOD V instance and the Digipede server can perform a man-in-the-middle (MitM) attack to sniff cleartext traffic or inject malicious data. The issue stems from a lack of HTTPS support in the underlying Digipede server integration. While the vendor reports a CVSS 4.0 score of 7.0, user interaction is noted as a requirement for the exploit vector.
Affected products
- Hitachi Energy PROMOD V 1.0.0 to 1.0.10
Timeline
- 2026-06-30: advisory: Initial advisory published by Hitachi Energy and NVD