Skip to content
ThreatCluster

Multiple Vulnerabilities Found in Hitachi Energy Products

First seen 21 Oct 2026, 02:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 03:18 UTC
  • •Critical vulnerabilities in Hitachi Energy's RTU500 and MicroSCADA X SYS600 products.
  • •CVE-2026-8927 and CVE-2026-9079 are rated critical with CVSS scores of 9.1 and 9.8.
  • •Users must update to the latest firmware to mitigate risks associated with these vulnerabilities.

Hitachi Energy has disclosed vulnerabilities affecting its RTU500 and MicroSCADA X SYS600 products. The RTU500 series is impacted by multiple CVEs, including CVE-2026-8927 and CVE-2026-9079, both rated as critical with CVSS scores of 9.1 and 9.8 respectively. The MicroSCADA X SYS600 is affected by CVE-2026-9853 and CVE-2026-9854, also rated high with CVSS scores of 8.5. These vulnerabilities can compromise the confidentiality, integrity, and availability of the systems. Users are advised to update to the latest firmware versions to mitigate these risks. The vulnerabilities affect critical infrastructure sectors, particularly energy, and are deployed worldwide. The vendor has provided recommended actions for remediation, including firmware updates and general mitigation strategies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-04-07
CVE-2026-28388 published
CVE-2026-28388, a high-severity vulnerability, was published affecting Hitachi Energy products.
Cisa
2026-04-23
CVE-2026-6732 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-13
CVE-2026-6276 published
CVE-2026-6276, rated high with CVSS 7.5, was published, affecting Hitachi Energy systems.
Cisa
2026-06-22
CVE-2026-6653 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-06-27
Public exploit for CVE-2026-8932 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-07-03
CVE-2026-8927 and CVE-2026-9079 published
CVE-2026-8927 and CVE-2026-9079, both critical vulnerabilities, were published.
Cisa
2026-07-03
CVE-2026-11856 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-03
CVE-2026-9852, CVE-2026-9853, CVE-2026-9854 published
Multiple vulnerabilities affecting MicroSCADA X SYS600 were published, rated high.
Cisa
2026-09-03
CVE-2026-17539 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Hitachi Energy issues advisories
Hitachi Energy published advisories for RTU500 and MicroSCADA X SYS600 products, urging updates.
Cisa

More articles in this cluster (2)

Following this threat?

Track Hitachi Energy and CVE-2026-11856 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (21)

1 / 3

Common questions

Which versions of RTU500 are affected?
RTU500 series CMU Firmware versions >=13.5.1 and <=12.7.7 are affected.
What should I do to mitigate these vulnerabilities?
Update to CMU Firmware version 13.9.1 or follow the recommended mitigation strategies.
Are these vulnerabilities actively exploited?
No, the vulnerabilities have been disclosed but there is no indication of active exploitation reported.