CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 30, 2026, 6:50 AM ET)

What this means for you

This week: 3,338 CVEs published, 226 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,338; Show in the list
Critical, last 7 days: 226; Show in the list
Healthcare-tagged, last 7 days: 3; Show in the list
Known exploited (CISA KEV): 1,764; Show in the list

Showing CVEs that name the product hitachi_energy:rtu500_series_cmu_firmware. Show all products

7 CVEs

Showing 1 to 7.

CVE	Severity	Title	Published
CVE-2026-1772	Medium 5.3	RTU500 web interface: An unprivileged user can read user management information. Assigned by Hitachi Energy	Feb 24, 2026
CVE-2026-1773	High 8.7	IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Assigned by Hitachi Energy	Feb 24, 2026
CVE-2026-8479	Medium 6.9	IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially crafted sequence of messages is sent for a certain time, causing Denial of Service… Assigned by Hitachi Energy	May 26, 2026
CVE-2026-17539	Medium 5.9	RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference in the last entry of the enhanced message queue. Assigned by Hitachi Energy	Sep 3, 2026
CVE-2026-8065	Critical 9.1	An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted… Assigned by Hitachi Energy	Sep 29, 2026
CVE-2026-8066	Critical 9.1	A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the devi… Assigned by Hitachi Energy	Sep 29, 2026
CVE-2026-8067	Medium 6.5	An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Assigned by Hitachi Energy	Sep 29, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.