# Hitachi Energy CoreTec vulnerabilities disclosed

Published: 2026-10-29 · Severity: elevated · Sectors: Energy
Canonical: https://vorant.io/reports/a811f5ad-cb35-5849-a46a-3754f0427e5f/hitachi-energy-coretec-vulnerabilities-disclosed
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CISA published an advisory for OS command injection and Dirty Frag flaws in Hitachi Energy CoreTec4 and CoreTec5 products used in energy infrastructure.

Source: cisa.gov — https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2026-43284 (weaponized); no exploitation in the wild is recorded.

Hitachi Energy, via CISA, disclosed two vulnerabilities affecting its CoreTec product line: CoreTec5 (versions up to 3.4.0 and 5.0.0) and CoreTec4 (versions up to 3.4.0). The flaws include an OS command injection vulnerability (CVE-2026-13162) affecting both product lines, and a write-what-where condition related to 'Dirty Frag' (CVE-2026-43284) affecting CoreTec5 specifically. Successful exploitation could impact the confidentiality, integrity, and availability of the affected devices. CVSS v3 scoring for CoreTec5 is rated 8.8.

The advisory does not indicate any evidence of active exploitation in the wild; it is a coordinated disclosure credited to researchers from Hitachi's own Cybersecurity Research group (India R&D Center). CoreTec products are deployed worldwide within the energy sector, and Hitachi Energy is headquartered in Switzerland. CISA republished this as a verbatim conversion of Hitachi Energy's own PSIRT advisory (8DBD000258).

Defenders operating CoreTec4 or CoreTec5 devices should consult Hitachi Energy directly for patch or remediation guidance, as this advisory does not specify fixed versions. In the interim, standard ICS network segmentation practices apply: minimize internet exposure of control system devices, place them behind firewalls isolated from business networks, and use VPNs with up-to-date patches for any required remote access. No IOCs, threat actors, or malware are associated with this disclosure — it is a vulnerability advisory, not an active campaign report.

## Mentioned in this report

- Vulnerabilities: CVE-2026-13162, CVE-2026-43284 (weaponized)

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a811f5ad-cb35-5849-a46a-3754f0427e5f/hitachi-energy-coretec-vulnerabilities-disclosed.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup