Vulnerabilities · 183 days ago

Java Deserialization RCE in Hitachi Energy Ellipse Reporting Component

Hitachi Energy Ellipse versions 9.0.50 and earlier include a vulnerable JasperReports library with a Java deserialization flaw (CVE-2025-10492). This flaw allows remote attackers to execute arbitrary code by exploiting the report generation feature. The vulnerability lies in a third-party component used for custom reports, not the core Ellipse application itself.

Because the exploit targets the reporting endpoints, network controls alone do not prevent attacks. Operators must update Ellipse to a fixed version or apply vendor mitigations such as disabling external report loading or restricting report access. This is critical for organizations in manufacturing and critical infrastructure sectors using Ellipse worldwide.

Timeline

• Apr 2 Reported by CISA Advisories

Sources

1 source covering this story

• CISA Advisories Apr 2

  Hitachi Energy Ellipse | CISA

  Hitachi Energy Ellipse Summary Hitachi Energy is aware of a Jasper Report vulnerability that affects the Ellipse product versions mentioned in this document below.

Entities

• CVE-2025-10492

Part of the PlainSec briefing for 2026-04-03

Editions

• Briefing for 2026-04-03

Related stories

• Next.js React2Shell Exploit Automates AI and Cloud Credential Theft
• TrueConf Update Flaw Lets Attackers Reach Isolated Government Networks
• Active Dawn Zero-Day in Chrome Enables Sandbox Escape