Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-8065 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-29 |
| Vendor | Hitachi Energy |
| Product | RTU500 (end-of-life versions) |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
The same Hitachi Energy advisory describes a second RTU500 flaw, CVE-2026-8066 (CVSS 9.1): a directory traversal in the file upload functionality lets an unauthenticated attacker write or overwrite arbitrary files on the device file system. The actions below cover both vulnerabilities.
Required Actions
Review Hitachi Energy’s security advisory and plan the migration of end-of-life RTU500 versions to supported firmware or hardware. Until then, isolate the devices from the IT network and the internet, restrict access to the firmware update endpoint to dedicated engineering workstations, and monitor OT network traffic.
Who Is Affected?
This vulnerability affects Hitachi Energy RTU500 remote terminal units in end-of-life versions. Check your OT asset inventory: which RTU500 units run at your sites, which firmware versions they use, and whether their management interface is reachable from other network segments.
Sources
Need help securing your OT systems? nFlo team offers OT/ICS penetration testing, OT/ICS security audits and vulnerability management. Contact us.
