1. Executive summary
Hitachi Energy has published two vulnerabilities in its TRO600 series products that can be exploited for remote code execution and disclosure of sensitive information. The affected versions are TRO600 up to and including 9.2.1.6 and 9.1.1.0, plus 9.2.2.1 and 9.1.2.0, tracked as CVE-2026-10756 and CVE-2026-106087. Hitachi Energy rates the flaws at CVSS v3 7.5 (high) and lists the affected sectors as energy, deployed worldwide. No CVSS vector, CWE mapping, EPSS score or CISA KEV entry is available for either CVE, so exploitation in the wild is unconfirmed. EMEA financial services exposure is indirect: the risk sits with clients whose operational technology, building management or remote-site infrastructure runs TRO600, or whose third-party providers do.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The advisory names two weakness classes: improper restriction of communication channel to intended endpoints, and missing authentication for critical function. Hitachi Energy states both can be exploited for remote code execution and disclosure of sensitive information. It gives no attack vector, no preconditions, no proof-of-concept and no exploitation detail beyond that. The following chain is therefore the confirmed sequence only, and it stops where the source stops.
- An attacker reaches a TRO600 endpoint over a communication channel that the product does not restrict to its intended endpoints (CWE class: improper restriction of communication channel to intended endpoints).
- A critical function on the device accepts the request without authentication (CWE class: missing authentication for critical function).
- The result is remote code execution on the TRO600 device, and separately disclosure of sensitive information.
Affected versions: TRO600 <=9.2.1.6, TRO600 <=9.1.1.0, 9.2.2.1 and 9.1.2.0. The advisory does not state which CVE maps to which weakness class, does not give the CVSS vector string, and does not name the vulnerable component, port or protocol. The SSVC decision recorded by the vendor is E:N/A:N (exploitation: none, automatable: no) as of 2026-10-26T14:54:19Z, which is consistent with no known in-the-wild activity at publication.
The combination matters for defenders. Missing authentication on a critical function means the device offers no credential barrier on that path, so network placement is the only control that separates an attacker from code execution. Improper restriction of the communication channel means the device does not enforce which endpoints it will talk to, so an attacker positioned on an adjacent segment or on a routed path to the device does not need to spoof a trusted peer.
No malware, payload, persistence mechanism, command-and-control channel, lateral movement technique, exfiltration path or observed impact is described in the source. No threat actor is named. Nothing in the source indicates ransomware, extortion or data theft.
Confidence caveat: the entire technical picture rests on a single vendor advisory (Hitachi Energy PSIRT 8DBD000224, republished verbatim by CISA as ICSA-26-302-02). CISA states it is a verbatim republication and does not vouch for technical accuracy. Treat the weakness classification as single-sourced until Hitachi Energy publishes the CVE records or a researcher reproduces the flaws.
4. Mitigation & containment
P1 (within 24h)
- Inventory every TRO600 device on the estate and record its firmware version against the affected list (<=9.2.1.6, <=9.1.1.0, 9.2.2.1, 9.1.2.0). Where the version cannot be read remotely, check it on site.
- Remove internet reachability from every TRO600 device. CISA's guidance is explicit: control system devices must not be accessible from the internet. Block inbound access at the perimeter and confirm with an external scan of the relevant address ranges.
- Place TRO600 devices behind a firewall and isolate them from business networks. Where a device sits on a flat segment, move it or insert a firewall or ACL between it and the rest of the estate.
- Where remote access to a TRO600 is required, route it through a VPN that is patched to its current version. CISA notes the VPN is only as secure as the device behind it, so this does not substitute for the isolation steps above.
P2 (within 72h)
- Apply the Hitachi Energy remediation for the affected versions. The advisory points to its Recommended Immediate Actions section for mitigation and remediation but the republished text does not carry the fixed version numbers; obtain them from Hitachi Energy PSIRT advisory 8DBD000224 or the Hitachi Energy service organisation (https://www.hitachienergy.com/contact-us/). Do not assume a version above 9.2.1.6 is fixed without that confirmation.
- Restrict the communication channel at the network layer, since the device does not do it itself: allow TRO600 traffic only to and from the specific management and peer endpoints it needs, and deny the rest.
- Prohibit use of TRO600 hosts and the segments they sit on for internet browsing, instant messaging or email, per the vendor's recommended practices.
P3 (within 7 days)
- Scan any portable computer or removable storage media before it connects to a control system network, per the vendor's recommended practices.
- Add TRO600 firmware versions to the asset register's patch-tracking so the next advisory revision is matched against the estate automatically.
- Review third-party and managed-service contracts that cover OT or remote-site infrastructure for a obligation to notify of vulnerabilities in supplied equipment; the device may not be yours to patch.
5. Indicators of compromise
No indicators of compromise available in the source material. The advisory gives no hashes, network indicators, file paths or command lines. It also describes no observable behaviours beyond the weakness classes in §3, so no behavioural indicator table is provided.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- CISA, Hitachi Energy TRO600 series products (ICSA-26-302-02), https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02, published 2026-10-29.
- Hitachi Energy PSIRT advisory 8DBD000224, the underlying vendor advisory republished by CISA; the CISA page is the only copy available and does not link a separate vendor URL.
8. Adverse Trace position
Adverse Trace assesses this as a high-severity, unconfirmed-exploitation vulnerability item: Hitachi Energy rates both CVEs at CVSS v3 7.5, the vendor's SSVC records no known exploitation and no automatable exploitation as of 2026-10-26, and no CISA KEV entry, EPSS score or public exploit exists in the data available to us. The technical detail is thin and single-sourced, so we are not raising client priority above the vendor's own rating. Client impact is confined to firms that run TRO600 themselves or depend on a provider that does; for those firms the exposure is code execution on a device that sits close to operational systems, and the only effective control until a fixed version is confirmed is network isolation. We will monitor Hitachi Energy PSIRT 8DBD000224 and the CVE records for CVE-2026-10756 and CVE-2026-106087 for fixed version numbers, CVSS vectors and any change in exploitation status, and will reissue this advisory if either CVE is added to CISA KEV or a public exploit appears.
Published via PulseTrace — Adverse Trace threat intelligence.