Hitachi Energy e-mesh EMS carries CVE-2026-42945 NGINX overflow
The fix list is simple, but the hotfix timing is not, which is how OT patch queues get ugly.
TL;DR
CISA republished Hitachi Energy’s advisory for CVE-2026-42945, an NGINX heap-based buffer overflow affecting e-mesh EMS 4.1.6, 4.4.2 and 4.7.0. The worldwide energy-sector footprint matters to DIB primes and state CISOs with OT dependencies. The immediate work is concrete: patch NGINX to v1.30.2 or later, keep ASLR active, check rewrite rules, and address Ubuntu 20.04 LTS exposure.
CISA’s July 7 republication puts CVE-2026-42945 into the ICS queue for Hitachi Energy e-mesh EMS 4.1.6, 4.4.2 and 4.7.0. The vulnerability sits in NGINX Plus and NGINX Open Source used by the product, specifically ngx_http_rewrite_module behavior when rewrite directives, unnamed PCRE captures and a question mark in a replacement string line up. Hitachi rates it CVSS v3.1 8.1 high; CVSS v4.0 lands at 9.2 critical. That is enough to move this out of the usual advisory pile for energy operators running e-mesh EMS.
The exploitation story has a condition, but the consequence is still ugly. Under the described rewrite-rule conditions, an unauthenticated attacker can send crafted HTTP requests and trigger a heap buffer overflow in the NGINX worker process, causing a restart and application outage. Code execution is possible where Address Space Layout Randomization is disabled or can be bypassed. The vulnerability manager can ticket it; the OT team has to verify the web-tier configuration.
The remediation path is specific: apply the relevant e-mesh EMS hotfix to move NGINX to v1.30.2 or later; ensure rewrite configuration does not use “?” to replace unnamed captures; and confirm ASLR is active with value 2 across deployment targets. For 4.1.6 and 4.4.2 systems still on Ubuntu Server 20.04 LTS, Hitachi adds the unglamorous operating-system work: upgrade to Ubuntu Server 22.04 or 24.04, or use Ubuntu Pro/ESM as an interim measure.
The thin part of the advisory is scheduling. It tells customers to apply hotfixes for the respective versions, but it does not give a per-version hotfix timeline or say whether all customers have been directly notified. For DIB primes and state CISOs tracking energy dependencies, the Monday action is inventory first, then patch or mitigate. A critical-infrastructure platform with an aging OS base and vulnerable NGINX layer is a bad place to discover that the asset list is aspirational.
Published ·Deep Fathom