CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the devic
Hitachi Energy RTU500 series CMU firmware
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.74%Chance of exploitation activity in the next 30 days, higher than 53% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 12.0RTU500 series CMU firmwareCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
Text from CVE List
Affected versions 1
- RTU500 series CMU firmwareaffected: 9.0 before 12.0CVE List