This vulnerability (CVE-2026-8065) in Hitachi Energy RTU500 series CMU firmware is due to missing authentication on a critical function—the firmware update endpoint. An attacker without any privileges can bypass authentication and upload arbitrary firmware by sending a specially crafted POST request. This can result in unauthorized modification of device behavior or disruption of device operations. The flaw affects firmware versions from 9.0 up to but excluding 12.0. No known exploits in the wild have been reported. The CVSS v3.1 base score is 9.1, reflecting network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

Successful exploitation allows an unauthenticated attacker to upload arbitrary firmware, potentially modifying device functionality or causing denial of service by compromising device integrity and availability. This poses a critical risk to operational continuity and security of affected RTU500 devices.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the firmware update endpoint and monitor for suspicious POST requests targeting this functionality.