Hitachi Energy
Vulnerability activity for Hitachi Energy: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.7HighOct 27, 2026Hitachi Energy CoreTec 5 Code / command injectionCVE-2026-13162An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system time-zone. When processing time-zone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.
- 7.7HighOct 27, 2026Hitachi Energy TRO600 Series FirmwareCVE-2026-10756TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.
- 8.7HighOct 27, 2026Hitachi Energy TRO600 Series Firmware Auth bypass / access controlCVE-2026-106087TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
- 5.9MediumSep 3, 2026Hitachi Energy RTU500 series CMU firmware Memory corruptionCVE-2026-17539RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. This can cause a BCI_IEC104 fatal write error, resulting in connection interruption and restart, and ultimately
- 8.5HighSep 3, 2026Hitachi Energy MicroSCADA SYS600CVE-2026-9854A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
- 8.5HighSep 3, 2026Hitachi Energy MicroSCADA SYS600CVE-2026-9853A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify appl
- 4.6MediumSep 3, 2026Hitachi Energy MicroSCADA SYS600CVE-2026-9852A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue att
Top products
- MicroSCADA SYS6003 CVEs in the last year
- TRO600 Series Firmware2 CVEs in the last year
- RTU500 series CMU firmware1 CVE in the last year
- CoreTec 51 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CISA · Oct 29, 2026Hitachi Energy CoreTec ProductCVE-2026-13162
- CISA · Oct 29, 2026Hitachi Energy TRO600 series productsCVE-2026-106087CVE-2026-10756
- CISA · Oct 20, 2026Hitachi Energy MicroSCADA X SYS600 ProductCVE-2026-9852CVE-2026-9853CVE-2026-9854
- CISA · Oct 20, 2026Hitachi Energy RTU500 ProductCVE-2026-17539
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.