CVE-2026-10763 describes a vulnerability in Hitachi Energy's PROMOD V product, version 1.0.0, where communication with a third-party Digipede server occurs over HTTP rather than HTTPS. This lack of encryption arises because the Digipede server does not support HTTPS, leading to reliance on insecure HTTP protocols. The vulnerability is categorized under CWE-1428, indicating reliance on insecure communication channels. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, high confidentiality impact, low integrity impact, and no availability impact. No official remediation or patch is currently available.

The use of HTTP instead of HTTPS for communication exposes sensitive data transmitted between PROMOD V and the Digipede server to interception and potential eavesdropping by attackers. This can lead to confidentiality breaches. The integrity impact is low, and availability is not affected. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by Hitachi Energy, users should monitor vendor communications for updates. In the meantime, consider network-level protections such as VPNs or secure tunnels to protect the HTTP traffic if possible. Avoid transmitting sensitive data over the affected communication channel until a secure solution is available.