Vulnerabilities

On October 20, 2026, CISA republished two Hitachi Energy advisories for substation equipment. ICSA-26-293-05 covers RTU500 series CMU firmware, with nine CVEs and a top CVSS v3 score of 8.8. ICSA-26-293-04 covers MicroSCADA X SYS600, with three CVEs, two of them rated CVSS v3 7.8, including one that lets an engineering-tool user become administrator on the Windows server underneath. Hitachi Energy first published both on September 1.

If you run a utility, an industrial site with its own substation, or a grid connection for a solar farm or data centre, check both product lines. Neither advisory reports exploitation, and CISA's SSVC entry for both records exploitation as "none". Treat this as work for the next maintenance window, sooner if your RTUs or the SYS600 server can be reached from the corporate network.

What these products do in a substation

An RTU (remote terminal unit) is the box in the substation that reads breaker positions, measurements and alarms from field devices, passes them to the control centre and carries commands back. Hitachi Energy describes the RTU500 as bringing "information from the physical power grid to your SCADA system". The advisory patches its CMU (communication unit) firmware, which carries the telecontrol protocols and the web-based management functions.

MicroSCADA X SYS600 sits a level up: the SCADA (supervisory control and data acquisition) application, running on a Windows server, that operators use to monitor and switch substations. Engineers configure it with separate engineering tools.

How the RTU500 flaws work

CISA's page heads the advisory "7 Vulnerabilities", counting weakness types, but it lists nine CVEs. Only one is in Hitachi Energy's own code. CVE-2026-17539 (CVSS 5.9) is in the IEC 60870-5-104 stack, the TCP-based telecontrol protocol that links an RTU to the control centre and runs on port 2404 by default. A GI (general interrogation) asks the RTU to resend every current value. If GI requests arrive at short intervals, the enhanced message queue can hit a NULL pointer, the BCI_IEC104 process fails, and the connection drops and restarts. Repeat it and bidirectional 104 traffic stops, so the control centre loses sight of the substation.

The other eight come from libraries bundled in the firmware:

• CVE-2026-6653 (CVSS 8.8, the advisory's highest) and CVE-2026-6732 (7.5) are libxml2 bugs, a use-after-free and a type confusion, reached by sending crafted XML to the RTU's XML-based services. Hitachi Energy describes the effect of both as denial of service.
• CVE-2026-28388 (7.5) is an OpenSSL crash triggered by a malformed delta CRL (certificate revocation list) during certificate checks. It needs delta CRL processing enabled and an attacker-supplied CRL, and cannot lead to code execution.
• Five are libcurl flaws in the web management functions, where a reused connection handle leaks something to the wrong destination: cookies (CVE-2026-6276, 7.5), a Digest Authorization header sent to a second host (CVE-2026-11856, 8.1), proxy credentials (CVE-2026-9079 and CVE-2026-8927, both 5.3) or an mTLS connection reused after its client certificate changed (CVE-2026-8932, 7.5).

Firmware 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8 and 13.8.1 to 13.8.2 is affected by all nine. Firmware 12.7.1 to 12.7.7 is listed only for CVE-2026-17539, CVE-2026-28388 and CVE-2026-6653.

How the SYS600 flaws work

CVE-2026-9854 (CVSS v3 7.8, v4 8.5) is in the RBAC (role-based access control) mechanism: a user with access to the engineering tools can raise their rights to administrator on the underlying Windows host. CVE-2026-9853 (same scores) lets any user who can log on to the server's operating system read and modify SYS600 application objects without logging on to SYS600 at all.

CVE-2026-9852 (CVSS v3 5.0) is CSV formula injection. If an attacker can write arbitrary log messages, through SCIL scripts (SYS600's own scripting language), a log injection bug or the SYS600 broker, the exported log can carry spreadsheet formulas. Depending on settings, opening the export in a spreadsheet can run code on the engineer's machine. All three flaws need local access to the server first.

What attackers are doing

Neither advisory reports exploitation in the wild or public exploit code. Hitachi Energy's internal team found the RTU500 issues; Sandia National Laboratories researchers in the CyTRICS programme reported the SYS600 ones. The risk to plan around is an intruder already on the OT network, for whom cutting an RTU's 104 link or turning an engineering login into Windows admin is a useful next step.

What to do

RTU500 CMU firmware. The fixed version depends on the line you run:

The 12.7.8 fix was added on September 29. A separate advisory, ICSA-26-279-06 from October 6, covers different flaws in end-of-life firmware 11.x and earlier; it points to the same 12.7.8 or 13.9.1, so sites on 11.x can plan one upgrade.

MicroSCADA X SYS600. Update anything on 10.7 or earlier to 10.8. For CVE-2026-9853 the update alone is not enough: the advisory still lists 10.8 as affected and tells you to apply the mitigation in Section 2.1.7.5 of the MicroSCADA X SYS600 10.8 Installation and Administration Manual (available from 10.3 onwards) and the MicroSCADA X 10.8 Cybersecurity Deployment Guide. You can do that before the upgrade.

If you cannot patch today. Hitachi Energy asks for control systems that are physically protected, have no internet connection and sit behind a firewall exposing as few ports as possible. In practice:

• Allow IEC 60870-5-104 (TCP 2404 unless you changed it) to the RTU only from your SCADA front-end addresses, and block it from everywhere else, including the corporate LAN.
• Restrict the RTU web management interface to an engineering jump host.
• On the SYS600 server, list who can log on to Windows locally or over RDP and remove anyone who does not operate or maintain SYS600. Every one of those accounts can currently use CVE-2026-9853.
• Limit engineering-tool access to named engineers, keep email and browsing off control systems, and scan laptops and removable media before they connect.

Checking for past abuse. No indicators are published, so look for effects. Review the 104 connection logs for repeated drops and reconnects to one RTU, and for GI requests from any address that is not your SCADA front end. On the SYS600 server, check membership of the local Administrators group and Windows Security log event 4732 (member added to a security-enabled local group) for additions you cannot match to a change record. Open exported SYS600 logs with formula evaluation off, or in a text editor first, and look for cells beginning with =, +, - or @.

Where the real risk sits

Eight of the nine RTU500 CVEs began as OpenSSL, libxml2 and libcurl advisories published between April and July 2026. Firmware gets those fixes only when the vendor rebuilds it and the operator installs it. An inventory of firmware versions per RTU, checked against vendor PSIRT notices, turns advisories like these into a work order within days.

Our network penetration tests check whether substation and SCADA networks are separated from corporate IT as designed, and our safeguarding and hardening work covers locking down Windows SCADA hosts and accounts. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: CISA ICSA-26-293-05, Hitachi Energy RTU500, CISA ICSA-26-293-04, Hitachi Energy MicroSCADA X SYS600, CISA CSAF for ICSA-26-293-05, CISA CSAF for ICSA-26-293-04, Hitachi Energy PSIRT 8DBD000259, Hitachi Energy PSIRT 8DBD000249, CVE-2026-17539 record, CVE-2026-9854 record, CISA ICSA-26-279-06, Hitachi Energy RTU500, Weidmuller IEC 60870-5-104 interoperability.