Vulnerabilities · 1 day ago
CISA’s advisory identifies nine vulnerabilities in Hitachi Energy RTU500 series CMU firmware across five version branches: 13.5.1–13.5.4, 13.6.1–13.6.3, 13.7.1–13.7.8, 13.8.1–13.8.2, and 12.7.1–12.7.7. CISA says exploitation could affect the product’s confidentiality, integrity, and availability.
The advisory does not describe a single fix for every affected unit. It lists version 13.9.1 for the branches, with 12.7.8 also listed for the 12.7 branch and 13.7.9 and 13.8.3 named as alternatives for two other branches. The correct remediation therefore depends on the unit’s firmware branch.
For operators with mixed RTU500 fleets, a uniform-looking update does not establish that every unit is covered: the advisory’s branch-specific fixes leave asset-to-fix mapping central to knowing which devices remain exposed.
CVEs in this update
9 CVEs
Across RTU500, Secure Connect Gateway, LANTIME, and related packages.
3 critical · 1 high · 2 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-11856 · 9.8 CRITICAL
Highest EPSS: CVE-2026-11856 · 0.69%
1 source covering this story
Hitachi Energy RTU500 Product | CISA
Hitachi Energy RTU500 Product Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document.
Part of the PlainSec briefing for 2026-10-21