Critical Remote Code Execution Vulnerabilities (CVE‑2026‑10756, CVE‑2026‑106087) in Hitachi Energy TRO600 Series Threaten Industrial Control Systems
What It Is — Hitachi Energy disclosed two high‑severity flaws in its TRO600 series (versions ≤ 9.2.1.6, 9.1.1.0, 9.2.2.1, 9.1.2.0). CVE‑2026‑10756 allows an authenticated attacker to bypass network‑access restrictions and reach services that should be reachable only from localhost, using port‑forwarding to interact with locally‑bound ports. CVE‑2026‑106087 is a missing‑authentication issue in a critical function that can be chained to achieve remote code execution (RCE) and disclosure of confidential information. Both receive a CVSS v3.1 base score of 7.5 (High). The vulnerabilities affect energy‑sector deployments worldwide. No public exploit is known, but CISA has added the advisory to its KEV list and recommends immediate mitigation.
Affected Products — Hitachi Energy TRO600 series (versions listed above).
Why It Matters for Trust & Control Assurance — The flaws expose gaps in network‑level access controls and authentication for critical functions, directly testing the “restrict access to privileged services” control objective that maps to many frameworks (e.g., NIST CSF, ISO 27001).
Recommended Actions —
- Apply Hitachi Energy’s remediation patches or upgrade to a non‑vulnerable version.
- Enforce strict network segmentation so that only authorized management stations can reach localhost‑bound services.
- Review and harden authentication mechanisms for all critical functions.
- Enable continuous monitoring of privileged access and log any anomalous port‑forwarding activity.
Source: CISA Advisory ICS‑A‑26‑302‑02