The short version
On 17 September 2026, CISA published ICSA-26-260-03 for the Hitachi Energy FACTS Control Platform, the control system behind STATCOMs, static VAR compensators and series capacitors on transmission networks. It covers five CVEs in the platform's GWS component. Two score 9.9.
There is no fixed version in the advisory. Remediation is "follow general mitigation factors" and a reference to Hitachi Energy's own advisory, 8DBD000229.
Small audience. Serious kit. FACTS devices are what a grid operator uses to hold voltage and control power flow on a line. A control platform that can be reached and rewritten over the network is a device that decides how much reactive power goes onto the transmission system.
What the advisory says
- Product: FACTS Control Platform (FCP) with the GWS component, versions 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0 and 4.1.1. Hitachi Energy says systems deployed from 2020 onwards are likely affected. Without GWS, not affected.
- Equipment: SVC Light (STATCOM), Fixed Series Capacitor, Thyristor Controlled Series Capacitor, Static Var Compensator, Static Watt Compensator, Hybrid Synchronous Condensers.
- The five flaws:
| CVE | CVSS v3.1 | Vector | What it is |
|---|---|---|---|
| CVE-2024-4872 | 9.9 | AV:N/AC:L/PR:L/UI:N/S:C | Code injection into persistent data through query validation. Needs a valid credential. |
| CVE-2024-3980 | 9.9 | AV:N/AC:L/PR:L/UI:N/S:C | Path traversal. An authenticated user can reach or modify system files. |
| CVE-2024-7940 | 8.3 | AV:N/AC:H/PR:N/UI:R/S:C | A service meant to be local only is exposed on all network interfaces, with no authentication. |
| CVE-2024-3982 | 8.2 | AV:L/AC:L/PR:H/UI:N/S:C | Session hijack via session logging. Local, needs an administrator to have enabled logging, which is off by default. |
| CVE-2024-7941 | 4.3 | AV:N/AC:L/PR:N/UI:R | Open redirect, usable for phishing credentials. |
- Remediation: none listed. General mitigation factors and Hitachi Energy advisory 8DBD000229.
- CISA's standing guidance: minimise network exposure, keep control systems off the internet, firewall them from business networks, and use a VPN for remote access, updated and understood to be only as secure as the devices on it.
Read the vector, not the score
Both 9.9s carry PR:L. They need a login. Not an administrator, any valid account. That is the fact to build the response around, because it means the attack surface is the list of accounts that can authenticate to the GWS component and the list of places those accounts can authenticate from.
The 8.3 is the other one to look at. A service intended for local use is listening on every interface, with no authentication. AC:H and UI:R make it harder to use than the score suggests, but "no authentication" on a transmission controller is not a phrase to leave in a report unaddressed.
The 4.3 open redirect is how the PR:L gets obtained. Phish a credential, log in, use one of the 9.9s. Read the five as a chain rather than a list.
When there is no patch, the perimeter is the patch
Hitachi Energy's mitigation factors are the usual four: physical protection, no direct internet connection, a firewall with the minimum ports open, and no office use on the control system. They are correct, and they are 2010 advice for a 2026 problem. A firewall decides which ports are open. It does not decide which person is behind the session on an open port, and both 9.9s work through a session that the firewall has already allowed.
What bounds this advisory is control of the session itself:
- One identity per person, including every vendor engineer, authenticated before anything connects, with a second factor in front of a platform that cannot ask for one itself.
- Each session scoped to the one system and the one protocol the job needs. The engineer working on the STATCOM controller does not get a route to the substation LAN.
- A time window and a recording. When the question is asked later, and on transmission assets it will be asked, the answer is a file.
That is also what CIP-005 describes as an intermediate system for interactive remote access, and it is the evidence CIP-007 and CIP-010 ask you to keep when a patch is not available. The control and the compliance artefact are the same thing.
What to do this week
- Confirm GWS. Ask Hitachi Energy, or check the installation, whether each FACTS system has the GWS component. Without it, you are out of scope for all five.
- Get advisory 8DBD000229 from Hitachi Energy and the remediation timeline for your FCP version.
- List every account that can authenticate to the platform, and every network path to it. Vendor service accounts included. The two 9.9s start from a valid login.
- Find the exposed service. CVE-2024-7940 is a local service listening on all interfaces. Identify the port and make sure nothing outside the controller's own zone can reach it.
- Check session logging. CVE-2024-3982 needs it enabled. It is off by default; confirm it is off on yours.
- Write the compensating control down. For a BES Cyber System with no patch available, the documented control, the access records and the review dates are what the audit will ask for.