As cited
Copy frozen at (site build).
vulnerabilities
Hitachi Energy CoreTec Product
Hitachi Energy disclosed two vulnerabilities in CoreTec industrial control system products: CVE-2026-13162, an OS command injection flaw in CoreTec5 and CoreTec4 versions 3.4.0 and prior that allows authenticated users to execute arbitrary system commands, and CVE-2026-43284, a privilege escalation flaw in CoreTec5's Linux kernel IPsec component that permits local unprivileged users to escalate to root. Both vulnerabilities affect critical infrastructure deployed worldwide and can compromise confidentiality, integrity, and availability; Hitachi Energy recommends updating CoreTec5 to version 5.0.0 and upgrading CoreTec4 to CoreTec5 version 5.0.0.
Why it matters: Energy and critical infrastructure operators running affected CoreTec versions must prioritize patching to version 5.0.0 to prevent authenticated attackers from gaining full device control or local privilege escalation that could disrupt operations.
- Source published
- First seen by Cybersecurity Tracker