Vulnerability Intelligence Report
CVE-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:3.9
Impact Score:5.2
EPSS Probability:0.58%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-306 ↗CWE-306 Missing authentication for critical function
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Hitachi Energy | RTU500 series CMU firmware | 9.0 < 12.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.577%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Hitachi Energy |
| Reserved | 2026-05-07T05:51:56 |
| Published | 2026-09-29T09:20:07 |
| Last Updated | 2026-09-29T15:54:11 |
Community Chatter & Buzz