Critical Authentication Bypass in Hitachi Energy RTU500 Firmware

• •CVE-2026-8065 allows unauthenticated firmware uploads to Hitachi Energy RTU500.
• •The vulnerability has a CVSS score of 9.1, marking it as critical.
• •Affected firmware versions include 9.0 and 12.0; testing should be done in isolated environments only.

On September 29, 2026, Hitachi Energy disclosed CVE-2026-8065, a critical authentication bypass vulnerability in the RTU500 Series CMU firmware update endpoint. This flaw allows unauthenticated attackers to upload arbitrary firmware, compromising the integrity and availability of the Remote Terminal Unit (RTU). The vulnerability has a CVSS score of 9.1, indicating its critical nature, particularly in operational technology (OT) environments. The affected firmware versions include 9.0 and 12.0, with advisories recommending testing only in isolated environments. The exploit involves sending crafted POST requests to the firmware update endpoint without authentication. Public advisories may not yet detail the exact URI for the vulnerability, and testing should be conducted only in controlled settings. The vendor has advised that the exploit should not be directed at live grid equipment without proper isolation and coordination.