The vulnerability CVE-2026-7395 in Hitachi Energy Asset Suite arises from missing authentication on the HTTPPublishAdapterTestServlet. This servlet is designed for testing purposes and should not be exposed in production. Unauthenticated attackers can exploit this to upload configuration files, potentially disclosing sensitive information and compromising data integrity. The affected versions are from 9.6.0 up to and including 9.9.0. The CVSS 4.0 base score is 8.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. Confidentiality and integrity impacts are high.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive configuration information and compromise the integrity of the system by allowing unauthorized configuration file uploads. This can undermine the security posture of the affected Asset Suite installations.

No explicit patch or remediation information is provided. Since the servlet is intended only for testing in non-production environments, the recommended mitigation is to ensure that the HTTPPublishAdapterTestServlet is disabled or removed in production deployments. Monitor vendor advisories for any official fixes or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.