Hitachi Energy CoreTec vulnerabilities disclosed
CISA published an advisory for OS command injection and Dirty Frag flaws in Hitachi Energy CoreTec4 and CoreTec5 products used in energy infrastructure.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-43284 (weaponized); no exploitation in the wild is recorded.
Hitachi Energy, via CISA, disclosed two vulnerabilities affecting its CoreTec product line: CoreTec5 (versions up to 3.4.0 and 5.0.0) and CoreTec4 (versions up to 3.4.0). The flaws include an OS command injection vulnerability (CVE-2026-13162) affecting both product lines, and a write-what-where condition related to 'Dirty Frag' (CVE-2026-43284) affecting CoreTec5 specifically. Successful exploitation could impact the confidentiality, integrity, and availability of the affected devices. CVSS v3 scoring for CoreTec5 is rated 8.8.
The advisory does not indicate any evidence of active exploitation in the wild; it is a coordinated disclosure credited to researchers from Hitachi's own Cybersecurity Research group (India R&D Center). CoreTec products are deployed worldwide within the energy sector, and Hitachi Energy is headquartered in Switzerland. CISA republished this as a verbatim conversion of Hitachi Energy's own PSIRT advisory (8DBD000258).
Defenders operating CoreTec4 or CoreTec5 devices should consult Hitachi Energy directly for patch or remediation guidance, as this advisory does not specify fixed versions. In the interim, standard ICS network segmentation practices apply: minimize internet exposure of control system devices, place them behind firewalls isolated from business networks, and use VPNs with up-to-date patches for any required remote access. No IOCs, threat actors, or malware are associated with this disclosure — it is a vulnerability advisory, not an active campaign report.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs