The short version
On October 20, 2026, CISA republished two Hitachi Energy advisories that cover the same substation stack. ICSA-26-293-05 lists nine CVEs in RTU500 series CMU firmware, all with a network attack vector, highest CVSS v3.1 8.8. The fix is firmware 13.9.1, or 12.7.8 on the 12.7 branch.
ICSA-26-293-04 lists three CVEs in MicroSCADA X SYS600, the SCADA system that supervises those RTUs. All three need local access to the SYS600 host. Two score 7.8: a user signed in to Windows can read and modify SYS600 application objects without signing in to SYS600, and a user with engineering tool access can become administrator of the Windows host.
Read together, the two advisories ask one question: who can reach the RTU's network services, and who can sign in to the SCADA host. The firmware update and SYS600 10.8 are the fixes. Until they are installed, the answer to that question is your control.
What the advisories say
- RTU500 (ICSA-26-293-05, Hitachi Energy 8DBD000259): CMU firmware 12.7.1 to 12.7.7, 13.5.1 to 13.5.4, 13.6.1 to 13.6.3, 13.7.1 to 13.7.8, 13.8.1 to 13.8.2. Reported by Hitachi Energy.
- SYS600 (ICSA-26-293-04, Hitachi Energy 8DBD000249): 10.7 and earlier, and 10.8. Reported by researchers at Sandia National Laboratories under the CyTRICS program.
- Both: Energy sector, deployed worldwide, vendor headquartered in Switzerland. First released by Hitachi Energy on September 1, 2026.
| CVE | Product | CVSS v3.1 | What it allows, per the advisory |
|---|---|---|---|
| CVE-2026-6653 | RTU500 | 8.8 | Use-after-free in libxml2 in the XML-based services, triggered by crafted XML. Needs low privileges |
| CVE-2026-11856 | RTU500 | 8.1 | libcurl may send Digest authentication headers to a second, unintended origin |
| CVE-2026-28388 | RTU500 | 7.5 | OpenSSL NULL dereference on a malformed delta CRL crashes certificate verification |
| CVE-2026-6732 | RTU500 | 7.5 | Type confusion in libxml2 on a crafted XSD-validated document, denial of service |
| CVE-2026-6276 | RTU500 | 7.5 | libcurl passes cookies meant for one host to another in the web management functions |
| CVE-2026-8932 | RTU500 | 7.5 | libcurl reuses a connection after mTLS settings change, bypassing the intended authentication |
| CVE-2026-17539 | RTU500 | 5.9 | GI requests at short intervals crash the IEC 60870-5-104 message queue |
| CVE-2026-9079 | RTU500 | 5.3 | Proxy credentials not cleared and reused |
| CVE-2026-8927 | RTU500 | 5.3 | Proxy-Authorization headers leak to a different proxy |
| CVE-2026-9853 | SYS600 | 7.8 | An OS-authenticated user reads and modifies SYS600 application objects without SYS600 authentication |
| CVE-2026-9854 | SYS600 | 7.8 | RBAC flaw: engineering tool access escalates to Windows administrator |
| CVE-2026-9852 | SYS600 | 5.0 | CSV injection in exported logs. Formulas run when a user opens the export |
RTU500 fixes by branch: 13.5.x and 13.6.x go to 13.9.1. 13.7.x goes to 13.9.1, or 13.7.9 when it is available. 13.8.x goes to 13.9.1 or 13.8.3. 12.7.x goes to 12.7.8 or 13.9.1. The advisory lists no product-specific workaround, only general mitigation factors.
SYS600 fixes: 10.8 fixes CVE-2026-9852 and CVE-2026-9854 on 10.7 and earlier. CVE-2026-9853 needs 10.8 and the mitigation strategy in section 2.1.7.5 of the 10.8 Installation and Administration Manual, plus the 10.8 Cybersecurity Deployment Guide. The advisory lists no remediation for CVE-2026-9854 on 10.8.
How the flaws reach a substation
The RTU500 flaws live in bundled libraries. libxml2 backs the XML-based services, libcurl the web-based management and services functions, OpenSSL the certificate checks. A host that can reach those services can send the crafted XML, the malformed CRL, or the burst of general interrogation requests. Most of the impact is denial of service: the RTU stops answering, and the control center loses that substation's data.
The libcurl flaws are about trust leaking. Cookies, proxy credentials and Digest headers can go to a host that should not get them. An attacker who controls that host collects them. The IEC 104 flaw needs a peer that can send general interrogation requests, which is normally the SCADA front end. For a related IEC 104 case, see our post on the ASE2000 test set and IEC 60870-5-104 TLS.
The SYS600 flaws start from a login on the host. CVE-2026-9853 means a Windows account on the SCADA server is enough to read and change SYS600 application objects. CVE-2026-9854 means an engineering tool user can take the whole host. Who can open an RDP session to that server, and from where, sets the reach of both.
The table maps the flaws to MITRE ATT&CK for ICS. It describes what the flaws allow, not an observed attack.
| Tactic | Technique (ID) | How it applies here |
|---|---|---|
| Initial Access | Exploit Public-Facing Application (T0819) | Conditional: RTU500 XML, TLS or web management services reachable beyond the control network |
| Initial Access, Lateral Movement | Remote Services (T0886) | An RDP session to the SYS600 host, the precondition for the local flaws |
| Persistence, Lateral Movement | Valid Accounts (T0859) | A Windows account on the SCADA host is enough for CVE-2026-9853. Leaked proxy or Digest credentials from the libcurl flaws |
| Privilege Escalation | Exploitation for Privilege Escalation (T0890) | Engineering tool access to Windows administrator, CVE-2026-9854 |
| Collection | Data from Information Repositories (T0811) | Reading SYS600 application objects without SYS600 authentication |
| Execution | User Execution (T0863) | A user opens an exported log with injected formulas, CVE-2026-9852 |
| Impair Process Control | Modify Parameter (T0836) | Possible consequence: changing SYS600 application objects |
| Inhibit Response Function | Denial of Service (T0814) | Crashing the RTU500 XML services, certificate checks or IEC 104 message queue |
| Impact | Loss of View (T0829) | Possible consequence: the control center loses telemetry from the RTU |
What to do, whatever you run
Inventory first. List every RTU500 CMU with its firmware branch, and every SYS600 server with its version. The branch decides the target release.
Plan the firmware. 13.9.1 covers every branch. On transmission or distribution assets, an RTU update is a planned outage and a test cycle, so schedule it now.
Shrink who reaches the RTU. Only the SCADA front end needs IEC 104, TCP 2404 by default. Only named engineers need web management. Ask Hitachi Energy which services can be turned off on your configuration, since the advisory names no workaround.
Treat the SYS600 host as a privileged system. Remove Windows accounts that do not need to be there. Apply section 2.1.7.5 on 10.8. List who holds engineering tool access, because CVE-2026-9854 turns it into host administrator.
Keep RTUs and SCADA hosts off the internet and behind firewalls, away from the business network, as CISA asks. Until 10.8 is installed, open exported SYS600 logs in a text viewer, not a spreadsheet.
How Access Gate helps, and its limits
Access Gate is an appliance installed at each site. It connects beside your existing network. One route on the current router then steers traffic to the RTUs and the SCADA host through it. Nothing is installed on the RTU or the server. It is installed in a day per site.
A per-machine rule decides who reaches each RTU. Access control lists are default deny. One rule lets the SCADA front end reach IEC 104. Another lets the engineering subnet reach web management. Every other host gets no route, which keeps the crafted XML, the malformed CRL and the GI burst away from the rest of the network.
A named engineer signs in first. An access screen asks for a directory login before a workstation reaches RTU web management. Access expires after 15 minutes, 1 hour or 8 hours.
Sessions to the SYS600 host are recorded. With privileged access management, RDP to the SCADA server opens in a browser session tied to a name, time-limited and recorded. That narrows who holds the Windows login CVE-2026-9853 needs, and records what an engineer did with the tools CVE-2026-9854 abuses. Every rule change lands in the enclave change history.
The limits are real. Access Gate does not patch either product, and it does not detect these CVEs. An allowed SCADA front end can still send a GI flood, and an engineer with a legitimate session can still exploit CVE-2026-9854. The firmware and SYS600 10.8 are still the fixes.
For NERC CIP, the gate is the evidence. CIP-005 R2 asks for interactive remote access through an Intermediate System with encryption and multi-factor authentication. CIP-007 R2 asks you to evaluate patches every 35 calendar days, then apply them or keep a dated mitigation plan. While an RTU waits for its outage window, the access rules and session records are that plan's proof. We covered the same pattern for Hitachi Energy FACTS. See also power grid, secure remote access and OT identity.
What to do this week
- List every RTU500 CMU and its firmware branch, and every SYS600 server and its version.
- Get 8DBD000259 and 8DBD000249 from Hitachi Energy PSIRT, and ask about CVE-2026-9854 on 10.8.
- Log the CIP-007 evaluation with today's date and pick update or mitigation plan per asset.
- Test who reaches IEC 104 and RTU web management from outside the control network.
- Audit Windows accounts and engineering tool users on every SYS600 host.
- Apply section 2.1.7.5 on SYS600 10.8.
- Route RDP to the SCADA host through one recorded, named entry point.
Want to see where a gate would sit in your substation? Build your network in a few minutes. Every other advisory we have covered is in the ICS security advisories archive.
Sources: CISA ICS Advisory ICSA-26-293-05 and CISA ICS Advisory ICSA-26-293-04 (October 20, 2026); the CISA Known Exploited Vulnerabilities catalog, version 2026.10.16, checked October 20, 2026; NERC Reliability Standards CIP-005-7 and CIP-007-6; and MITRE ATT&CK for ICS. Confirm affected versions and update steps with Hitachi Energy before changing a production RTU or SCADA server.