Threat Investigation
Request a demo

CVE-2026-8065

Critical

Description

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

SeverityCritical
CVSS9.1
Exploit probability—
ProductRTU500 series CMU firmware
PublishedSep 29, 2026
First seenSep 29, 2026
Weakness typeCWE-306Missing authentication for critical function

How to fix

Update
  • Hitachi Energy RTU500 series CMU firmware12.0 or later

Affected products

ProductAffected versionsFixed in
Hitachi Energy RTU500 series CMU firmware9.0 ≤ v < 12.012.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.