CVE-2026-10763 identifies a security vulnerability in Hitachi Energy's PROMOD V product, version 1.0.0, where communication with a third-party Digipede server is conducted over HTTP rather than HTTPS. This lack of encrypted communication can lead to confidentiality and integrity risks for data transmitted between PROMOD V and the Digipede server. The vulnerability stems from the third-party server's lack of HTTPS support, not from PROMOD V itself. No official remediation or patch has been provided by Hitachi Energy as of the publication date.

The use of HTTP instead of HTTPS allows attackers to potentially intercept or alter data in transit between PROMOD V and the Digipede server. This can lead to exposure of sensitive information or manipulation of communications. The CVSS 4.0 score of 7 indicates a high severity impact, primarily due to network attack vector, low attack complexity, no privileges required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability arises from the third-party Digipede server's lack of HTTPS support, mitigation options may be limited until the third party implements HTTPS. Users should monitor vendor advisories for updates. No official fix or temporary workaround has been announced by Hitachi Energy.