Vulnerability · Published Sep 29, 2026 · Assigned by Hitachi Energy
CVE-2026-8065
Critical 9.1
In plain English
A critical-severity missing authentication in RTU500 series CMU firmware from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 9.0 – before 12.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H