# Hitachi Energy vulnerabilities Source: https://junglewise.ai/threats/vendors/hitachi-energy Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/hitachi-energy.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in Hitachi Energy: 0 in the last 7 days and 13 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-10756, was published on 27 October 2026. 2 vulnerabilities in the last four weeks, down 71% on the four before (7). 0 critical against 2. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 13 - All time: 18 (2 critical, 0 exploited in the wild) ## About Hitachi Energy Hitachi Energy is a global provider of power systems and electrical infrastructure solutions. ## Latest Hitachi Energy vulnerabilities - [CVE-2026-10756: Hitachi Energy TRO600 network access restriction bypass](https://junglewise.ai/threats/cve-2026-10756-tro600-contains-a-vulnerability-that-allows-an-authenticated) (high, published 27 Oct 2026) - [CVE-2026-106087: Hitachi Energy TRO600 arbitrary file read](https://junglewise.ai/threats/cve-2026-106087-tro600-contains-an-arbitrary-file-read-vulnerability-an) (info, published 27 Oct 2026) - [CVE-2024-8176: Hitachi Energy REB500 denial of service in open-source dependencies](https://junglewise.ai/threats/cve-2024-8176-hitachi-energy-reb500) (high, published 6 Oct 2026) - [CVE-2026-8067: Hitachi Energy RTU500 improper authorization in web application](https://junglewise.ai/threats/cve-2026-8067-an-improper-authorization-vulnerability-in-the-rtu500-s-web) (medium, CVSS 6.5, published 29 Sep 2026) - [CVE-2026-8066: Hitachi Energy RTU500 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-8066-a-directory-traversal-vulnerability-in-the-file-upload) (critical, CVSS 9.1, published 29 Sep 2026) - [CVE-2026-8065: Hitachi Energy RTU500 firmware update authentication bypass](https://junglewise.ai/threats/cve-2026-8065-an-authentication-bypass-vulnerability-in-the-firmware-update) (critical, CVSS 9.1, published 29 Sep 2026) - [CVE-2026-7395: Hitachi Energy Asset Suite unauthenticated access to HTTPPublishAdapterTestServlet](https://junglewise.ai/threats/cve-2026-7395-asset-suite-allows-unauthenticated-users-to-access) (high, published 29 Sep 2026) - [CVE-2026-11796: Hitachi Energy Asset Suite unauthenticated servlet access](https://junglewise.ai/threats/cve-2026-11796-asset-suite-allows-unauthenticated-users-to-access) (info, published 29 Sep 2026) - [CVE-2024-4872: Hitachi Energy FACTS Control Platform multiple vulnerabilities in GWS component](https://junglewise.ai/threats/cve-2024-4872-hitachi-energy-facts-control-platform-multiple-vulnerabilities-in) (high, CVSS 9.9, published 17 Sep 2026) - [CVE-2026-9854: Hitachi Energy SYS600 privilege escalation in RBAC mechanism](https://junglewise.ai/threats/cve-2026-9854-hitachi-energy-sys600-privilege-escalation-in-rbac-mechanism) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-9853: Hitachi Energy SYS600 unauthorized access to application objects](https://junglewise.ai/threats/cve-2026-9853-hitachi-energy-sys600-unauthorized-access-to-application-objects) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-9852: Hitachi Energy SYS600 CSV injection in logs](https://junglewise.ai/threats/cve-2026-9852-hitachi-energy-sys600-csv-injection-in-logs) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-17539: Hitachi Energy RTU500 NULL pointer dereference in IEC 104 messaging](https://junglewise.ai/threats/cve-2026-17539-hitachi-energy-rtu500-null-pointer-dereference-in-iec-104) (high, CVSS 5.9, published 3 Sep 2026) - [CVE-2026-10763: Hitachi Energy PROMOD V use of unencrypted HTTP in Digipede communication](https://junglewise.ai/threats/cve-2026-10763-hitachi-energy-promod-v-use-of-unencrypted-http-in-digipede) (info, CVSS 7, published 30 Jun 2026) - [CVE-2026-8479: Hitachi Energy IEC 60870-5-104 NULL pointer dereference DoS](https://junglewise.ai/threats/cve-2026-8479-hitachi-energy-iec-60870-5-104-null-pointer-dereference-dos) (info, CVSS 6.9, published 26 May 2026) - [CVE-2026-7310: Hitachi Energy HiDraw heap overflow in XML parser](https://junglewise.ai/threats/cve-2026-7310-hitachi-energy-hidraw-heap-overflow-in-xml-parser) (info, CVSS 4.4, published 26 May 2026) - [CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption](https://junglewise.ai/threats/cve-2022-4304-hitachi-energy-gms600-observable-discrepancy-in-openssl-rsa) (high, CVSS 3.1, published 7 Feb 2023) - [CVE-2018-1002208: Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib](https://junglewise.ai/threats/cve-2018-1002208-abb-pcm600) (high, CVSS 3.1, published 13 May 2022) ## Most severe Hitachi Energy vulnerabilities - [CVE-2026-8066: Hitachi Energy RTU500 directory traversal in file upload](https://junglewise.ai/threats/cve-2026-8066-a-directory-traversal-vulnerability-in-the-file-upload) (critical, CVSS 9.1, published 29 Sep 2026) - [CVE-2026-8065: Hitachi Energy RTU500 firmware update authentication bypass](https://junglewise.ai/threats/cve-2026-8065-an-authentication-bypass-vulnerability-in-the-firmware-update) (critical, CVSS 9.1, published 29 Sep 2026) - [CVE-2024-4872: Hitachi Energy FACTS Control Platform multiple vulnerabilities in GWS component](https://junglewise.ai/threats/cve-2024-4872-hitachi-energy-facts-control-platform-multiple-vulnerabilities-in) (high, CVSS 9.9, published 17 Sep 2026) - [CVE-2026-9852: Hitachi Energy SYS600 CSV injection in logs](https://junglewise.ai/threats/cve-2026-9852-hitachi-energy-sys600-csv-injection-in-logs) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-9854: Hitachi Energy SYS600 privilege escalation in RBAC mechanism](https://junglewise.ai/threats/cve-2026-9854-hitachi-energy-sys600-privilege-escalation-in-rbac-mechanism) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-9853: Hitachi Energy SYS600 unauthorized access to application objects](https://junglewise.ai/threats/cve-2026-9853-hitachi-energy-sys600-unauthorized-access-to-application-objects) (high, CVSS 7.8, published 3 Sep 2026) - [CVE-2026-17539: Hitachi Energy RTU500 NULL pointer dereference in IEC 104 messaging](https://junglewise.ai/threats/cve-2026-17539-hitachi-energy-rtu500-null-pointer-dereference-in-iec-104) (high, CVSS 5.9, published 3 Sep 2026) - [CVE-2022-4304: RUSTSEC-2023-0007 - Timing Oracle in RSA Decryption](https://junglewise.ai/threats/cve-2022-4304-hitachi-energy-gms600-observable-discrepancy-in-openssl-rsa) (high, CVSS 3.1, published 7 Feb 2023) - [CVE-2018-1002208: Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib](https://junglewise.ai/threats/cve-2018-1002208-abb-pcm600) (high, CVSS 3.1, published 13 May 2022) - [CVE-2026-10756: Hitachi Energy TRO600 network access restriction bypass](https://junglewise.ai/threats/cve-2026-10756-tro600-contains-a-vulnerability-that-allows-an-authenticated) (high, published 27 Oct 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 71% on the four before (7). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 5 | 2 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Hitachi Energy technologies - [Hitachi Energy RTU500](https://junglewise.ai/threats/technologies/rtu500): 4 vulnerabilities - [Hitachi Energy SYS600](https://junglewise.ai/threats/technologies/sys600): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Hitachi Energy vulnerabilities", https://junglewise.ai/threats/vendors/hitachi-energy, 9 November 2026.