A substation unit is patched, though sites on older firmware must upgrade or wait.

Hitachi Energy has published fixes for nine security defects in the firmware of a device that sits inside substations, gathering readings from the switchgear and passing control room commands back the other way.

None of the nine is a dramatic story on its own. Together they cover two things an operations manager cares about. The link carrying telemetry can be made to drop and restart. And the unit's web management interface can hand credentials and session cookies to a machine that was never meant to see them.

The remedies are where it gets practical. Five firmware lines are affected. One has a point update available now. Two have a point update listed, but not confirmed as released. The remaining two have no point update at all: for those sites the corrected build sits on the newest line, which is an upgrade rather than a patch. On plant that has to stay up, those are not the same job and they do not carry the same testing burden.

This is a piece for whoever keeps the firmware record against a substation asset register. The reach is wide: the advisory records worldwide deployment and names energy as the affected sector, which takes in utilities, transmission and distribution companies, and the mines and smelters running their own distribution networks.

What a dropped link costs

The availability defect has a shape anyone who has sat near a control room will recognise. Under heavy load, with one kind of polling request arriving in quick succession, the unit's message handling can fail, interrupting the connection and restarting it. The advisory's own rating treats this as hard to arrange rather than trivial.

For the length of that drop, readings from the substation stop updating and commands sent to it do not land. A supervisor is then working from a phone call to someone on site instead of the screen in front of them, and the question of whether to send a crew is being settled without the data that normally settles it. Where the unit sits behind a feeder serving a mill or a shaft, that uncertainty costs money before anything has actually broken.

The heaviest score in the advisory is somewhere else again, on a memory-handling defect in one of the open source libraries the firmware uses to read structured data files. That is worth pausing on, because it sets the pattern. Most of these defects are not in the vendor's own code. They sit in widely used open source components bundled into the firmware, the libraries that handle encrypted connections, certificate checking, web requests and document parsing, which is why nine arrive together rather than one at a time.

The credential defects need a different frame. The unit's management and service functions can, in four distinct ways, send authentication material meant for one destination to a different one: cookies, an authorisation header, proxy credentials. A fifth lets an existing connection carry on in use after the certificate settings governing it have changed, which defeats the point of having configured them. The practical reading is disclosure and misdirected authentication rather than control of the unit. What it erodes is the assumption that credentials put on that device stay where they were put, and that assumption is usually load-bearing in however remote access to the substation was signed off.

The questions for the firmware record

The first one is dull and decides everything else: which firmware line is each unit on? Remediation differs line by line. A site on one of the two lines with no point update is scheduling an upgrade. A site on one of the two with a point update pending is choosing between waiting with no date attached and that same upgrade.

The question to put to the integrator or service provider is which of those routes they will support and when. Moving across firmware lines on a substation unit is a different conversation from taking a point release: it touches what has been type-tested, what the configuration tooling expects, and whether the window needed is an hour or a shift.

Second: what reaches the unit's management interface today, and from where? The disclosure defects all turn on credentials intended for one destination arriving at another, which makes the list of machines that talk to that interface the document worth having in hand before anyone discusses mitigations.

Third, and this is about where you look rather than what you own. The agency notice is a republication of the vendor's own advisory, so the vendor is the authority here and the version detail will be current in its channel first. The timing makes the point. The vendor published this on 1 September and revised it at the end of that month to add one of the fixed versions; the agency's republication is dated 20 October. A site watching only the second of those two channels spent seven weeks not knowing it had a decision to make, and the next revision, the one that will say whether the pending point release exists, is going to appear in the same order.

The technical record

Product and affected versions: Hitachi Energy RTU500 series CMU Firmware, versions 12.7.1 to 12.7.7, 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8, and 13.8.1 to 13.8.2.

Remediation: CMU Firmware 13.9.1 for all five lines; 12.7.8 for the 12.7 line; 13.7.9 for the 13.7 line, listed as not yet available; 13.8.3 for the 13.8 line, asterisked in the advisory. The 13.5 and 13.6 lines carry no alternative to 13.9.1.

Nine identifiers across seven weakness classes, headline rating CVSS v3 8.8.

• CVE-2026-6653, 8.8, CWE-416 use after free: libxml2 internal subset parsing, crafted XML input, remote denial of service.
• CVE-2026-11856, 8.1, CWE-294: Digest authentication header for one origin sent to a second, disclosing authentication information to an unintended host.
• CVE-2026-28388, 7.5, CWE-476: OpenSSL NULL pointer dereference on a malformed delta CRL during X.509 verification; denial of service only, not code execution or memory disclosure.
• CVE-2026-6732, 7.5, CWE-843 type confusion: crafted XSD-validated XML document in libxml2, denial of service.
• CVE-2026-6276, 7.5, CWE-319: libcurl passes cookies meant for a first host on to a second.
• CVE-2026-8932, 7.5, CWE-305: libcurl connection reuse after client certificate or private key settings change, bypassing the intended authentication configuration.
• CVE-2026-17539, 5.9, CWE-476: message queue NULL pointer dereference under high load, denial of service for two-way IEC 60870-5-104 communication; high attack complexity.
• CVE-2026-9079, 5.3, CWE-522, and CVE-2026-8927, 5.3, CWE-294: libcurl proxy authentication credentials not cleared between transfers.

Reporting and status: reported to CISA by Hitachi Energy's internal team; energy sector, deployed worldwide; SSVC exploitation value of none.

Revisions and provenance: first published 1 September 2026, revised 29 September 2026 to add the 12.7.8 fixed version, republished by CISA on 20 October 2026. The agency document carries the vendor's notice, Hitachi Energy PSIRT 8DBD000259, converted from its machine-readable form.