Hitachi Energy published two advisories on 27 October, which CISA republished on 29 October. In the TRO600 series, one flaw lets a logged-in attacker reach services meant only for the device itself. A second lets an attacker who isn't logged in read files, including configuration and password data. In CoreTec4 and CoreTec5, a command injection flaw lets logged-in users with certain roles run any command. CoreTec5 is also affected by a Linux kernel flaw that can give a local user root access. Affected products and IDs ICSA-26-302-02 (Hitachi Energy 8DBD000224), TRO600: CVE-2026-10756 (CVSS 7.5), affects 9.2.1.6 and earlier; CVE-2026-106087 (CVSS v3 7.5, v4 8.7), affects 9.2.1.6 and earlier, and 9.1.1.0 and earlier. Fixed in 9.2.2.1 (9.1.2.0 also fixes CVE-2026-106087, but Hitachi Energy recommends 9.2.2.1). ICSA-26-302-03 (Hitachi Energy 8DBD000258), CoreTec: CVE-2026-13162 (CVSS v3 7.5, v4 7.7) and CVE-2026-43284 (CVSS 8.8, CoreTec5 only). Affects CoreTec4 3.4.0 and earlier and CoreTec5 3.4.0 and earlier. Fixed by moving to CoreTec5 5.0.0. Exploitation status None known, according to the advisories. Why it matters to OT operators CISA lists energy as the affected sector for both products. Operators should plan the vendor updates. Until then, keep the devices behind firewalls, don't connect them directly to the internet, and follow Hitachi Energy's general ICS security advice. Sources CISA ICSA-26-302-02, Hitachi Energy TRO600 Series, 29 Oct 2026 CISA ICSA-26-302-03, Hitachi Energy CoreTec, 29 Oct 2026 Source dates: 29 Oct 2026; 29 Oct 2026.
Hitachi Energy published two advisories on 27 October, which CISA republished on 29 October. In the TRO600 series, one flaw lets a logged-in attacker reach services meant only for the device itself. A second lets an attacker who isn't logged in read files, including configuration and password data. In CoreTec4 and CoreTec5, a command injection flaw lets logged-in users with certain roles run any command. CoreTec5 is also affected by a Linux kernel flaw that can give a local user root access. Affected products and IDs ICSA-26-302-02 (Hitachi Energy 8DBD000224), TRO600: CVE-2026-10756 (CVSS 7.5), affects 9.2.1.6 and earlier; CVE-2026-106087 (CVSS v3 7.5, v4 8.7), affects 9.2.1.6 and earlier, and 9.1.1.0 and earlier. Fixed in 9.2.2.1 (9.1.2.0 also fixes CVE-2026-106087, but Hitachi Energy recommends 9.2.2.1). ICSA-26-302-03 (Hitachi Energy 8DBD000258), CoreTec: CVE-2026-13162 (CVSS v3 7.5, v4 7.7) and CVE-2026-43284 (CVSS 8.8, CoreTec5 only). Affects CoreTec4 3.4.0 and earlier and CoreTec5 3.4.0 and earlier. Fixed by moving to CoreTec5 5.0.0. Exploitation status None known, according to the advisories. Why it matters to OT operators CISA lists energy as the affected sector for both products. Operators should plan the vendor updates. Until then, keep the devices behind firewalls, don't connect them directly to the internet, and follow Hitachi Energy's general ICS security advice. Sources CISA ICSA-26-302-02, Hitachi Energy TRO600 Series, 29 Oct 2026 CISA ICSA-26-302-03, Hitachi Energy CoreTec, 29 Oct 2026 Source dates: 29 Oct 2026; 29 Oct 2026.