CVE-2026-8065 Auth bypass in RTU500 series CMU firmware
Unauthenticated attackers can bypass authentication to upload arbitrary firmware on Hitachi Energy RTU500 devices, compromising device integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8065?
CVE-2026-8065 is a critical authentication bypass vulnerability in Hitachi Energy RTU500 series CMU firmware, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device.
Weakness: CWE-306
Which versions are affected by CVE-2026-8065?
How do I fix CVE-2026-8065?
No fix has been published for CVE-2026-8065 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-8065 being exploited?
There is no known exploitation of CVE-2026-8065 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-gg49-9mrv-ff3f.