Plan ahead High Patch available CVSS up to 8.8
Hitachi Energy CoreTec flaws allow full device control by authenticated users
CISA ICS AdvisoriesHitachi Energy · energyCVE-2026-13162, CVE-2026-43284
What happened. Hitachi Energy reported an operating system (OS) command injection flaw and a second flaw called Dirty Frag in CoreTec products. An authenticated user with certain roles could run system commands with full control of the device.
Who is affected. Energy-sector users of Hitachi Energy CoreTec5 (up to 3.4.0, and 5.0.0) and Hitachi Energy CoreTec4 (up to 3.4.0).
What to do. Check whether you run CoreTec5 or CoreTec4 at the listed versions, then follow the vendor's Recommended Immediate Actions for mitigation or remediation.
When to act. Plan ahead: EPSS 94% chance of exploitation within 30 days
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: The report does not say where CoreTec sits in the plant; it is an energy-sector network product with a configuration daemon, so site operations levels are the closest fit.
- Are you exposed?
Search the asset inventory for CoreTec4 and CoreTec5 at versions up to 3.4.0, or 5.0.0, and check who holds the roles that can change configuration.
- If you cannot fix it yet
- Restrict management access to CoreTec devices to known administrator hosts through a firewall.
- Review which accounts hold the roles that can change configuration and remove any not needed.
- Watch for
- Unexpected system commands or changes to time synchronisation settings on CoreTec devices.
- Logons to CoreTec devices by authenticated accounts from unusual hosts or at unusual times.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Hitachi Energy Energy and power CVE-2026-13162 CVE-2026-43284