Story · 1 source · 4 articlesfirst Oct 6, 12:00 UTCupdated Oct 6, 12:00 UTC (2d ago)

CISA Warns of Flaws in Four Hitachi Energy Products

highAdvisoryimportance 66CVE-2026-8065 CVE-2026-8066 CVE-2026-8067 CVE-2010-2965 CVE-2014-9195 CVE-2023-46143 CVE-2026-34197 CVE-2026-7395

What's new: First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrives

CISA warned October 6, 2026 of vulnerabilities in four Hitachi Energy products, with no reported exploitation and upgrades recommended.

CISA published four non-conflicting advisories on October 6, 2026, covering separate Hitachi Energy products used in the energy sector. End-of-life RTU500 series CMU firmware 11.x and earlier, based on Dragos findings, has unauthenticated firmware-upload and file-write flaws CVE-2026-8065 and CVE-2026-8066 (both CVSS 9.1), low-privilege reboot issue CVE-2026-8067 (CVSS 6.5), and legacy issues including CVE-2010-2965 (CVSS 9.8) plus CVE-2014-9195 and CVE-2023-46143; supported releases are unaffected, and Hitachi Energy recommends 12.7.8, 13.9.1, or later. Advisory ICSA-26-279-04 says SOI 2.0.0 through 2.2.0 has authenticated ActiveMQ code-injection flaw CVE-2026-34197 (CVSS 8.8, CWE-94), fixed by patch EP2, which upgrades the broker to ActiveMQ 5.19.5 and OpenJDK 11. Asset Suite 9.9.0 and earlier, reported by EDF, exposes unauthenticated servlets via CVE-2026-7395 (CVSS 8.1) and CVE-2026-11796 (CVSS 4.3); Hitachi Energy says to upgrade to 9.9.1 when available and disable the affected servlets. Advisory ICSA-26-279-05 says REB500 8.3.3.1 and earlier can be disrupted by authenticated IEC 61850 parsing bugs CVE-2024-8176 and CVE-2025-59375 (both CVSS 6.5), fixed in 8.3.4.0. Across the advisories, exploitation is not reported.

On 2026-10-06, CISA issued advisories for four Hitachi Energy energy-sector products: RTU500, SOI, Asset Suite, and REB500.
End-of-life RTU500 CMU firmware 11.x and earlier is affected by unauthenticated CVE-2026-8065 and CVE-2026-8066 (both CVSS 9.1), CVE-2026-8067 (CVSS 6.5), and legacy CVE-2010-2965 (CVSS 9.8, VxWorks WDB on UDP 17185), plus CVE-2014-9195…
SOI 2.0.0 through 2.2.0 has authenticated CVE-2026-34197 (CVSS 3.1 8.8, CWE-94) in Apache ActiveMQ (advisory ICSA-26-279-04); patch EP2 upgrades the Core broker to ActiveMQ 5.19.5 and OpenJDK 11.
Asset Suite 9.9.0 and earlier has unauthenticated CVE-2026-7395 (CVSS 8.1) and CVE-2026-11796 (CVSS 4.3), reported by EDF; Hitachi Energy advises upgrading to 9.9.1 when available and disabling the affected servlets.
REB500 8.3.3.1 and earlier is affected by libexpat issues CVE-2024-8176 and CVE-2025-59375 (both CVSS 3.1 6.5; the latter in Expat before 2.7.2) in IEC 61850 parsing (advisory ICSA-26-279-05); the fix is version 8.3.4.0.
CISA reports no exploitation: SSVC lists none for SOI and not observed for REB500, and exploitation is not reported for RTU500 or Asset Suite.

VendorsHitachi Energy Wind River Apache

ProductsRTU500 VxWorks SOI Apache ActiveMQ Asset Suite REB500 libexpat

OrganizationsCISA Dragos EDF

CountriesSwitzerland

Coverage timelineoldest first · each row is one article

Oct 6, 12:00 UTC · 2d ago
CISA Advisories· 66
Hitachi Energy RTU500
CISA warns end-of-life Hitachi Energy RTU500 firmware has critical unauthenticated flaws, including arbitrary firmware upload.
Oct 6, 12:00 UTC · 2d ago
CISA Advisories· 36
Hitachi Energy REB500
Hitachi Energy REB500 8.3.3.1 and earlier can be crashed via libexpat flaws in IEC 61850 parsing.
Oct 6, 12:00 UTC · 2d ago
CISA Advisories· 55
Hitachi Energy Asset Suite
Hitachi Energy Asset Suite 9.9.0 and earlier expose unauthenticated servlets that can leak data or disrupt availability.

Vulnerabilities in this storyAll →

CVE-2010-2965——
published —
CVE-2014-9195——
published —
CVE-2023-461437.5<1%
Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all…

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2010-2965	NVD description · AI analysis pending	—	—		—	—	—
CVE-2014-9195	NVD description · AI analysis pending	—	—		—	—	—
CVE-2023-46143	Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all… Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC. NVD description · AI analysis pending	7.5	<1%		phoenixcontact automationworx software suite phoenixcontact axc 1050 firmware phoenixcontact axc 1050 xc firmware +1 more	—	Dec 14, 2023
CVE-2024-8176	A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. NVD description · AI analysis pending	7.5	1%		—	—	Mar 14, 2025
CVE-2025-59375	libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. NVD description · AI analysis pending	7.5	1%	PoC ×2	libexpat project libexpat	—	Sep 15, 2025
CVE-2026-11796	Missing auth on Asset Suite servlets can cause DoS Hitachi Energy Asset Suite allows unauthenticated users to reach PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet (CWE-306, missing authentication for a critical function). Those servlets perform maintenance actions such as flushing caches and reloading properties, metadata, or resource bundles, and invoking them can cause denial-of-service conditions that affect application availability, depending on how the product is configured. Impact is limited to availability; the CVSS 4.0 score is 5.1 (medium), with no confidentiality or integrity impact on the vulnerable system. The product is enterprise asset-management software used in energy and utility environments; affected version ranges were not stated in the provided data. No public proof-of-concept is known, and the CVE is not listed in CISA KEV. Do: Block unauthenticated access to PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, and keep those management endpoints off the internet and limited to trusted administrative networks. Apply Hitachi Energy’s official patch or hardening guidance for Asset Suite as soon as it is available for your deployment, and watch application logs for unexpected cache flushes or configuration reloads until the fix is in place.	5.1	—		Hitachi Energy Asset Suite	—	9d ago
CVE-2026-34197	Authenticated RCE in Apache ActiveMQ via Jolokia JMX-HTTP Bridge Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console, and the default Jolokia access policy allows authenticated users to invoke exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker abuses these operations with a crafted discovery URI so that the VM transport's brokerConfig parameter loads a remote Spring XML application context; because ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, arbitrary code runs in the broker's JVM (e.g., through Runtime.exec() bean factory methods), yielding code execution with the broker's privileges. Affected users are those running Apache ActiveMQ Broker, ActiveMQ All, or ActiveMQ (Classic) on versions before 5.19.4 or 6.x versions from 6.0.0 before 6.2.3. Authentication to the web console is required (CVSS privileges-required: low), but CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-16 amid reported active exploitation, and EPSS puts 30-day exploitation probability at 98.3%. No public proof-of-concept is known, and whether ransomware groups are using it is unknown. Do: Upgrade Apache ActiveMQ to 5.19.4 (5.x line) or 6.2.3 (6.x line), which fix the issue; federal agencies must apply mitigations under BOD 22-01 timelines. As interim mitigation, restrict access to the web console /api/jolokia/ endpoint, tighten the Jolokia access policy so exec is not permitted on org.apache.activemq:* MBeans (especially BrokerService.addNetworkConnector/addConnector), and enforce strong authentication. Review broker logs for Jolokia calls to these operations and for unexpected VM-transport connector additions.	8.8	15%	KEV
CVE-2026-7395	Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information… Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment. NVD description · AI analysis pending	8.5	—		—	—	9d ago
CVE-2026-8065	An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to… An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device. NVD description · AI analysis pending	9.1	<1%	PoC	—	—	9d ago
CVE-2026-8066	A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write… A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation. NVD description · AI analysis pending	9.1	—		—	—	9d ago
CVE-2026-8067	Authenticated reboot via improper authorization in Hitachi Energy RTU500 CVE-2026-8067 is an improper authorization flaw (CWE-862) in the web application of end-of-life Hitachi Energy RTU500 units. An authenticated, low-privileged user on the network can call the reset endpoint and force the RTU to reboot. Successful use causes temporary device unavailability and can disrupt the RTU’s intended operation; confidentiality and integrity are not affected (CVSS 3.1 base score 6.5, availability high). Only end-of-life RTU500 versions are described as affected; exact version numbers are not stated. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Treat end-of-life RTU500 units as unsupported: plan replacement or migration to a currently supported Hitachi Energy RTU release, and until then limit the web application to trusted management networks and accounts. Review who holds authenticated access, and alert on unexpected reboots or use of the reset function. No fixed version number is given in the advisory data.	6.5	—		Hitachi Energy RTU500	—	9d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2010-2965

NVD description · AI analysis pending

—

CVE-2014-9195

NVD description · AI analysis pending

—

CVE-2023-46143

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all…

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC.

NVD description · AI analysis pending

7.5

<1%

phoenixcontact automationworx software suite
phoenixcontact axc 1050 firmware
phoenixcontact axc 1050 xc firmware
+1 more

—

Dec 14, 2023

CVE-2024-8176

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

NVD description · AI analysis pending

7.5

—

Mar 14, 2025

CVE-2025-59375

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

NVD description · AI analysis pending

7.5

PoC ×2

libexpat project libexpat

—

Sep 15, 2025

CVE-2026-11796

Missing auth on Asset Suite servlets can cause DoS

Hitachi Energy Asset Suite allows unauthenticated users to reach PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet (CWE-306, missing authentication for a critical function). Those servlets perform maintenance actions such as flushing caches and reloading properties, metadata, or resource bundles, and invoking them can cause denial-of-service conditions that affect application availability, depending on how the product is configured. Impact is limited to availability; the CVSS 4.0 score is 5.1 (medium), with no confidentiality or integrity impact on the vulnerable system. The product is enterprise asset-management software used in energy and utility environments; affected version ranges were not stated in the provided data. No public proof-of-concept is known, and the CVE is not listed in CISA KEV.

Do: Block unauthenticated access to PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet, and ResourceBundleReloadServlet, and keep those management endpoints off the internet and limited to trusted administrative networks. Apply Hitachi Energy’s official patch or hardening guidance for Asset Suite as soon as it is available for your deployment, and watch application logs for unexpected cache flushes or configuration reloads until the fix is in place.

5.1

—

Hitachi Energy Asset Suite

—

9d ago

CVE-2026-34197

Authenticated RCE in Apache ActiveMQ via Jolokia JMX-HTTP Bridge

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on its web console, and the default Jolokia access policy allows authenticated users to invoke exec operations on all ActiveMQ MBeans, including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker abuses these operations with a crafted discovery URI so that the VM transport's brokerConfig parameter loads a remote Spring XML application context; because ResourceXmlApplicationContext instantiates singleton beans before the BrokerService validates the configuration, arbitrary code runs in the broker's JVM (e.g., through Runtime.exec() bean factory methods), yielding code execution with the broker's privileges. Affected users are those running Apache ActiveMQ Broker, ActiveMQ All, or ActiveMQ (Classic) on versions before 5.19.4 or 6.x versions from 6.0.0 before 6.2.3. Authentication to the web console is required (CVSS privileges-required: low), but CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-04-16 amid reported active exploitation, and EPSS puts 30-day exploitation probability at 98.3%. No public proof-of-concept is known, and whether ransomware groups are using it is unknown.

Do: Upgrade Apache ActiveMQ to 5.19.4 (5.x line) or 6.2.3 (6.x line), which fix the issue; federal agencies must apply mitigations under BOD 22-01 timelines. As interim mitigation, restrict access to the web console /api/jolokia/ endpoint, tighten the Jolokia access policy so exec is not permitted on org.apache.activemq:* MBeans (especially BrokerService.addNetworkConnector/addConnector), and enforce strong authentication. Review broker logs for Jolokia calls to these operations and for unexpected VM-transport connector additions.

8.8

15%

KEV

CVE-2026-7395

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information…

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.

NVD description · AI analysis pending

8.5

—

9d ago

CVE-2026-8065

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to…

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

NVD description · AI analysis pending

9.1

<1%

PoC

—

9d ago

CVE-2026-8066

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write…

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

NVD description · AI analysis pending

9.1

—

9d ago

CVE-2026-8067

Authenticated reboot via improper authorization in Hitachi Energy RTU500

CVE-2026-8067 is an improper authorization flaw (CWE-862) in the web application of end-of-life Hitachi Energy RTU500 units. An authenticated, low-privileged user on the network can call the reset endpoint and force the RTU to reboot. Successful use causes temporary device unavailability and can disrupt the RTU’s intended operation; confidentiality and integrity are not affected (CVSS 3.1 base score 6.5, availability high). Only end-of-life RTU500 versions are described as affected; exact version numbers are not stated. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat end-of-life RTU500 units as unsupported: plan replacement or migration to a currently supported Hitachi Energy RTU release, and until then limit the web application to trusted management networks and accounts. Review who holds authenticated access, and alert on unexpected reboots or use of the reset function. No fixed version number is given in the advisory data.

6.5

—

Hitachi Energy RTU500

—

9d ago