Security feed

24 October 2026

advisoryCriticalOfficial CVE List24 Oct 2026

CVE-2026-8066

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

Announced 29 Sept 2026

RTU500 series CMU firmware CVE-2026-8066

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-8066

RTU500 series CMU firmware

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-8066
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3794 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:49 GMT
Publisher date: Tue, 29 Sep 2026 09:24:05 GMT

Read the original announcement

advisoryCriticalOfficial CVE List24 Oct 2026

CVE-2026-8065

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.

Announced 29 Sept 2026

RTU500 series CMU firmware CVE-2026-8065

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-8065

RTU500 series CMU firmware

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-8065
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #3793 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:40:48 GMT
Publisher date: Tue, 29 Sep 2026 09:20:07 GMT

Read the original announcement

advisoryMediumOfficial CVE List24 Oct 2026

CVE-2026-8067

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

Announced 29 Sept 2026

RTU500 series CMU firmware CVE-2026-8067

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-8067

RTU500 series CMU firmware

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-8067
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #3489 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:36:06 GMT
Publisher date: Tue, 29 Sep 2026 09:33:52 GMT

Read the original announcement