Dirty Frag Vulnerabilities Discovered in Hitachi Energy APM Edge Product

Hitachi Energy has acknowledged two kernel-level vulnerabilities impacting its APM Edge product, a platform used in energy sector infrastructure. The first, CVE-2026-43284, is a Write-what-where condition in the IPsec ESP subsystem (esp4, esp6). It allows a local unprivileged user to craft malicious ESP encrypted network packets that cause the Linux kernel to decrypt data into memory pages it does not own, including cached copies of privileged operating system binaries. Execution of one of those binaries triggers attacker-controlled code with root privileges.

The second, CVE-2026-43500, is an Out-of-bounds Write flaw in the RxRPC protocol implementation of the Linux kernel. Similar to the first, it involves incorrect processing of incoming network packets that carry externally owned memory fragments. The kernel writes decrypted data into memory pages it does not own, including cached privileged binaries. Execution of a corrupted binary results in root-level code execution.

Both vulnerabilities affect APM Edge versions 6.10 and prior. In the affected product, the vulnerable kernel modules (esp4, esp6 for CVE-2026-43284; rxrpc for CVE-2026-43500) can be loaded by any local user, making privilege escalation feasible without prior authentication.

CISA published the advisory (ICSA-26-225-04) on August 13, 2026, noting that the researcher who reported the issues was the Hitachi Energy Internal Team. The CVSS v3.1 base scores are 8.8 for CVE-2026-43284 and 7.8 for CVE-2026-43500, both classified as HIGH. While the advisory describes the flaws as theoretically exploitable by local users, it does not confirm active exploitation in the wild.

Hitachi Energy's recommended immediate actions include disabling the esp4 and esp6 kernel modules (for CVE-2026-43284) and disabling the rxrpc module (for CVE-2026-43500). The company has not released a software patch addressing the kernel flaws directly; mitigation relies on module disabling and adherence to process control network security practices such as physical isolation and restricted local access.