# CVE-2026-8066: Hitachi Energy RTU500 directory traversal in file upload

Source: https://junglewise.ai/threats/cve-2026-8066-a-directory-traversal-vulnerability-in-the-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-8066 · Severity: critical · CVSS 9.1 · Published 2026-09-29

Hitachi Energy RTU500 is an industrial remote terminal unit used to monitor and control power systems. An unauthenticated attacker can exploit a directory traversal flaw in the file upload feature to write or overwrite arbitrary files on the device. Successful exploitation could modify device configuration, corrupt data, or cause the device to malfunction, disrupting critical power infrastructure.

Technologies: [Hitachi Energy RTU500](https://junglewise.ai/threats/technologies/rtu500). Vendors: [Hitachi Energy](https://junglewise.ai/threats/vendors/hitachi-energy).

## Quick answers

**Is CVE-2026-8066 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8066 being exploited in the wild.

**How severe is CVE-2026-8066?** Critical severity, with a CVSS score of 9.1, published 29 September 2026.

**Which products and versions are affected?** Hitachi Energy RTU500.

**Is there a fix for CVE-2026-8066?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8066 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8066?** Check whether you run Hitachi Energy RTU500. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A directory traversal vulnerability exists in the file upload functionality, allowing path traversal sequences to bypass directory restrictions. An unauthenticated attacker can upload files with crafted paths to write or overwrite arbitrary files on the RTU500 file system. Depending on which files are modified, this can result in device compromise, data tampering, or denial of service.

## Affected products

- Hitachi Energy RTU500

## Timeline

- 2026-09-29: disclosed

## References

- [https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch](https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch)

## Related threats

- [Hitachi Energy RTU500 improper authorization in web application](https://junglewise.ai/threats/cve-2026-8067-an-improper-authorization-vulnerability-in-the-rtu500-s-web)
- [Hitachi Energy RTU500 firmware update authentication bypass](https://junglewise.ai/threats/cve-2026-8065-an-authentication-bypass-vulnerability-in-the-firmware-update)
- [Hitachi Energy RTU500 NULL pointer dereference in IEC 104 messaging](https://junglewise.ai/threats/cve-2026-17539-hitachi-energy-rtu500-null-pointer-dereference-in-iec-104)