Critical severity · published Sep 29, 2026
CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite…
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
RTU500 series CMU firmware · Hitachi Energy
9.0 before 12.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8066
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch
More from RTU500 series CMU firmware
9.1
CVE-2026-8065
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary…
8.2
CVE-2024-1531
A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below
7.5
CVE-2026-1773
IEC 60870-5-104 used in RTU500: Potential Denial of Service impact on reception of invalid U-format frame. Product is only affected if IEC 60870-5-104 bi-directional functionality…
7.5
CVE-2022-2081
A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above
7.5
CVE-2023-6711
Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below