Is CVE-2026-11856 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-11856

Update CMU Firmware to version 13.9.1 for most affected release series. Specific upgrade paths: 13.5.1-13.5.4 → 13.9.1; 13.6.1-13.6.3 → 13.9.1; 13.7.1-13.7.8 → 13.9.1 or 13.7.9 (when available); 13.8.1-13.8.2 → 13.9.1 or 13.8.3*; 12.7.1-12.7.7 → 12.7.8 OR upgrade to 13.9.1. Follow general mitigation factors/workarounds until patching is completed.

Quick answers

What is CVE-2026-11856?: Update CMU Firmware to version 13.9.1 for most affected release series. Specific upgrade paths: 13.5.1-13.5.4 → 13.9.1; 13.6.1-13.6.3 → 13.9.1; 13.7.1-13.7.8 → 13.9.1 or 13.7.9 (when available); 13.8.1-13.8.2 → 13.9.1 or 13.8.3*; 12.7.1-12.7.7 → 12.7.8 OR upgrade to 13.9.1. Follow general mitigation factors/workarounds until patching is completed.
How severe is CVE-2026-11856?: high, CVSS 5.9
Is CVE-2026-11856 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-11856 be mitigated?: Update CMU Firmware to version 13.9.1 for most affected release series. Specific upgrade paths: 13.5.1-13.5.4 → 13.9.1; 13.6.1-13.6.3 → 13.9.1; 13.7.1-13.7.8 → 13.9.1 or 13.7.9 (when available); 13.8.1-13.8.2 → 13.9.1 or 13.8.3*; 12.7.1-12.7.7 → 12.7.8 OR upgrade to 13.9.1. Follow general mitigation factors/workarounds until patching is completed.

CVSS

5.9

Vendor

Hitachi Energy

Published

Oct 21, 2026 · 01:13

Patch

Unknown / not confirmed

Affected products

RTU500 series CMU Firmware

Mitigation

Multiple Vulnerabilities Discovered in Hitachi Energy RTU500 Series CMU Firmware

Hitachi Energy has disclosed seven vulnerabilities affecting the RTU500 series CMU Firmware across multiple version ranges. The flaws range from NULL pointer dereference and type confusion to authentication bypass vulnerabilities that could impact the confidentiality, integrity, and availability of energy sector industrial control systems. CISA has issued advisory ICSA-26-293-05 with remediation guidance.

—2m

CVE-2026-11856

Quick answers

Related News

Multiple Vulnerabilities Discovered in Hitachi Energy RTU500 Series CMU Firmware