On 29 October 2026 CISA published three ICS advisories covering four CVEs. Two of the three advisories concern Hitachi Energy grid equipment: the TRO600 series routers carry two 7.5-severity flaws, one of them missing authentication for a critical function, and the CoreTec4/CoreTec5 transformer monitoring hubs carry an OS command injection plus a Linux kernel privilege-escalation flaw. Both CoreTec issues are resolved by CoreTec5 version 5.0.0. The third advisory covers a Siemens Mendix SAML module replay bug scored 6.8, not the 8.8 that has circulated in some summaries. None of the four CVEs appears in CISA's Known Exploited Vulnerabilities catalog as of 30 October 2026.
Key takeaways
- Three advisories, four CVEs, zero hardware recalls. Every fix in the release is a software or firmware update.
- Hitachi Energy accounts for three of the four CVEs. Remediation targets are TRO600 firmware 9.2.2.1 and CoreTec5 5.0.0.
- CoreTec4 at 3.4.0 or earlier has no fixed version listed in the advisory, only mitigations. That is the item that needs a lifecycle decision, not just a patch ticket.
- The 8.8 in this release belongs to CoreTec, not Mendix. CVE-2026-43284 is the Linux kernel write-what-where primitive behind the Dirty Frag vulnerability family.
- The kernel flaw sits in an exploited neighbourhood. Fragnesia, the sibling page-cache-write bug, entered CISA's KEV catalog on 28 October, one day before this advisory, and CISA's own KEV note describes chaining it with two PHP remote-code-execution CVEs to plant webshells and run as root.
The three advisories at a glance
CISA's 29 October ICS release consists of ICSA-26-302-01 (Siemens), ICSA-26-302-02 (Hitachi Energy TRO600) and ICSA-26-302-03 (Hitachi Energy CoreTec). Four CVEs are distributed across them, and the scoring is not uniform: the two Hitachi Energy advisories carry remote and local paths, while the Siemens item is a medium-severity authentication bypass that becomes urgent only if you run identity-provider-initiated single sign-on.
| Product and CVE | Fixed in |
|---|---|
| Siemens Mendix SAML CVE-2026-89209 · replay bypass 6.8 |
4.2.4 (Mendix 10/11) 3.6.29 (Mendix 9) or disable IdP-initiated SSO |
| Hitachi Energy TRO600 CVE-2026-10756 · channel restriction 7.5 (v4.0: 7.7) |
9.2.2.1, with 9.1.2.0 also stated as fixed |
| Hitachi Energy TRO600 CVE-2026-106087 · missing authentication 7.5 (v4.0: 8.7) |
9.2.2.1, with 9.1.2.0 also stated as fixed |
| Hitachi Energy CoreTec4/5 CVE-2026-13162 · OS command injection 7.5 |
CoreTec5 5.0.0 |
| Hitachi Energy CoreTec5 CVE-2026-43284 · kernel write-what-where 8.8 |
CoreTec5 5.0.0 |
Two details in that table deserve more attention than the scores. The first is that the Hitachi Energy advisories are tagged to the Energy sector and deployed worldwide, which is a different exposure profile from a low-code platform. The second is that both Hitachi Energy advisories contain version lists that are internally ambiguous, and we will come back to that because it changes how you verify a fix.
Why the Hitachi Energy half of this release matters more
Hitachi Energy was named the world's leading supplier of grid automation products and services by ARC Advisory Group in 2025, and that position is built on exactly the kind of equipment named in these two advisories: communication hardware at the edge of the network and monitoring devices attached to transformers. A router flaw and a hub flaw look small next to a controller vulnerability, but these devices sit in places where the usual compensating control — "it is behind the firewall" — is often only half true.
A cellular router is, by design, a device with a route to the outside world. A transformer monitoring hub is, by design, a device that talks to sensors and to a data platform. Neither can be treated as an isolated island, and both are frequently managed by a small team that also covers protection, SCADA and substation communications.
For readers who plan around the longer policy picture rather than a single patch cycle, the same logic appeared in our review of CISA's 2030 strategy and what it means for legacy PLCs and spare-parts planning: the weak point is rarely the newest controller, it is the connectivity and monitoring layer that grew up around it.
TRO600: what the two flaws actually allow
The TRO600 series is Hitachi Energy's rugged cellular router line for utility and industrial field connectivity; the TRO610, developed with ASUS IoT, is the model the company has been positioning for distribution automation and IIoT edge use. The advisory covers the series at 9.2.1.6 and earlier, and 9.1.1.0 and earlier. Its attention line is blunt: "Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document."
The two CVEs are different in kind. CVE-2026-106087 is missing authentication for a critical function (CWE-306). CISA scores it 7.5 on the v3.1 scale with a network vector, low attack complexity, no privileges and no user interaction, and 8.7 on the newer v4.0 scale — the gap reflects how much weight v4.0 places on subsequent system impact. In plain terms, an unauthenticated attacker who can reach the affected function does not need credentials. CVE-2026-10756 is improper restriction of a communication channel to intended endpoints (CWE-923), also 7.5, but with high attack complexity and low privileges — an authenticated path that can lead to remote code execution. The advisory's combined impact statement lists remote code execution, unauthorised access and sensitive information disclosure.
| Question | Answer |
|---|---|
| Does the flaw need credentials? | One of the two does not. CVE-2026-106087 is scored with no privileges required; CVE-2026-10756 requires a low-privileged account. |
| Is the router reachable from the internet? | Only where its management interface is exposed. On utility networks the realistic exposure is the operations VLAN, vendor remote-access links and any cellular backhaul that terminates inside the OT zone. |
| Which version is clean? | The advisory names 9.2.2.1 as the update target and states 9.1.2.0 is fixed — but both 9.2.2.1 and 9.1.2.0 also appear in the affected-version line. Record the build string from the device itself before you close the ticket. |
| What if the units are in service and cannot be taken down? | Restrict management access to a jump host, remove the device from any path that accepts unsolicited inbound sessions, and log all administrative connections until the firmware window opens. |
That third row is not pedantry. Version data in advisories is generated from vendor-supplied ranges, and when the "fixed in" value also appears in the affected list, the only safe reading is that the range is a set of build numbers rather than a clean cut-off. Take the version from the device's status page or CLI, not from the purchase order, and put the exact string in your asset register.
CoreTec: a root-level flaw inside the transformer hub
CoreTec is the computing platform inside Hitachi Energy's TXpert Hub, the data aggregator that collects dissolved-gas, moisture, bushing and tap-changer measurements from a transformer and passes them north to monitoring and asset-management software. It is the kind of device an operations team installs once and then forgets, which is precisely why an 8.8 on it deserves a second look.
The advisory's attention line reads: "Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities." Those are two very different problems sharing one fix.
CVE-2026-13162 is an OS command injection (CWE-78) scored 7.5, network-reachable but with high attack complexity and low privileges required. An attacker who gets there can run commands on the hub. CVE-2026-43284 is a write-what-where condition (CWE-123) in the Linux kernel, scored 8.8 with a local vector, low complexity, low privileges and a scope change — the description states that a local user can escalate privileges to root by exploiting memory handling in the kernel's IPsec ESP subsystem.
That second CVE is the interesting one, because it is not a Hitachi Energy code defect at all. It is the kernel bug that security researchers grouped into the Dirty Frag family, and it is the same CVE that appears in kernel advisories from every major Linux distribution. Its presence in an OT advisory tells you something practical: the hub runs an embedded Linux image, and updating CoreTec means replacing that image, not applying a small hotfix. The same applies to any OT appliance with a Linux base — which, in 2026, is most of them.
Root on a monitoring hub is not a cosmetic outcome. The hub is a trusted peer to protection and monitoring devices and to the platform that stores transformer health history. An attacker with root can alter the data the utility uses to decide when to take a transformer out of service, and can use the hub's network position to reach the next device. Integrity of measurement is the product; losing it defeats the purpose of installing monitoring in the first place.
Two caveats belong in the maintenance record. First, the affected list includes CoreTec5 5.0.0 while the remediation is also CoreTec5 5.0.0 — confirm the build with Hitachi Energy PSIRT before assuming a unit that reports 5.0.0 is patched. Second, CoreTec4 at 3.4.0 or earlier is listed as affected with no fixed version in the advisory. If you still run CoreTec4, the realistic options are compensating controls now and a replacement or upgrade plan this budget year.
The Siemens Mendix SAML bug, and a number that drifted
The Siemens advisory covers the Mendix SAML module, the single-sign-on component that lets Mendix low-code applications authenticate against a corporate identity provider. CVE-2026-89209 is an authentication bypass by capture-replay (CWE-294): in identity-provider-initiated flows, the module does not adequately protect against replay of a SAML assertion, so an unauthenticated remote attacker can replay a valid assertion and gain access.
The score is 6.8, and the vector explains why: network reachable, but high attack complexity, no privileges, and user interaction required. The fixed versions are 4.2.4 for Mendix 10 and 11 compatible builds and 3.6.29 for Mendix 9 compatible builds. Where patching has to wait for an application release cycle, Siemens' own workaround is to disable IdP-initiated SSO; service-provider-initiated login continues to work, so most users will not notice.
It is worth correcting a figure that has travelled quickly. Several Chinese-language roundups of the 29 October release assign a CVSS of 8.8 to the Mendix flaw. The advisory says 6.8. The 8.8 in this release belongs to CVE-2026-43284, the kernel flaw in the CoreTec advisory. If your risk register was populated from the roundup rather than the advisory, the Mendix item may be ranked above the item that actually carries the higher score.
Where Mendix matters in a plant is the application layer: dashboards, quality and OEE apps, workflow tools that sit on top of MES and historians and authenticate through the corporate directory. A bypass there does not reach a PLC directly, but it does put an attacker inside an application that holds production data and often holds credentials to other systems. That is the same lesson as our earlier look at PHP2Shell and industrial web interfaces — the web tier is part of the OT attack surface even when it is not part of the control loop.
Why the kernel CVE lands in an exploited neighbourhood
The chronology around this release is more informative than any single score.
On 26 October, CISA added two PHP vulnerabilities to the KEV catalog: CVE-2026-109618 (out-of-memory corruption leading to unauthenticated remote code execution) and CVE-2026-109619 (stale internal request state, also unauthenticated remote code execution). On 28 October it added Fragnesia, CVE-2026-46300, a Linux kernel page-cache write bug in the Dirty family. The KEV entry for Fragnesia states that it can be chained with those two PHP CVEs to implant PHP webshells and run commands as root. On 29 October, the CoreTec advisory arrived carrying CVE-2026-43284, the Dirty Frag kernel write primitive.
The honest reading is narrower than the headline. CVE-2026-43284 itself is not in KEV; Fragnesia is a different CVE in the same family. But the pattern CISA described is exactly the pattern that applies to OT appliances: a web front end running PHP, an embedded Linux kernel that has not been rebuilt, and a device that sits on a network segment with more trust than it deserves. If you operate equipment with a PHP-based web interface, the two PHP CVEs are already known-exploited, and a kernel escalation on the same box turns a webshell into root.
This is also why the fix for CoreTec is a version jump rather than a configuration change. Kernel-level fixes cannot be back-ported into a field device by a support engineer with a settings file; they arrive as a new image.
A patch order that fits a maintenance window
Three advisories, four CVEs and two vendors is not a complicated queue, but the sequencing matters because the fastest fix is not the highest score.
| Window | Action |
|---|---|
| Next 24 hours | Inventory every TRO600 and CoreTec on the estate with the build string from the device. Check whether any Mendix application uses IdP-initiated SSO. Remove management interfaces from anything that accepts inbound sessions from outside the OT zone. |
| Week 1 | If IdP-initiated SSO is in use and the SAML module cannot be updated immediately, disable it — the workaround is a configuration change and the application team can usually do it the same day. Put the Mendix module update into the next application release. |
| Week 2 to 4 | Stage TRO600 firmware 9.2.2.1 in a lab, confirm the build with Hitachi Energy PSIRT, then roll to field units. Schedule CoreTec5 5.0.0 in a planned outage; export configuration before the update. |
| This quarter | Decide the CoreTec4 path: upgrade, replace, or documented compensating controls with a dated review. Add the kernel image date to the asset register for every Linux-based OT appliance. |
| Ongoing | Record build numbers rather than marketing versions in the patch register, and re-check KEV weekly — the two PHP CVEs and Fragnesia all arrived within 72 hours of this release. |
Segmentation still does the heavy lifting while patches are in flight. Where the network design allows it, put the TRO600 management plane behind a dedicated jump host and keep the CoreTec hub on a monitoring VLAN that can talk north to the data platform but not laterally to protection devices. A Siemens SCALANCE S602 firewall module or a Honeywell CC-PCF901 control firewall in an existing rack is often the quickest way to enforce that boundary without redesigning the plant network.
What this changes for spares and service planning
Every one of these advisories is a firmware story, and firmware is where spare-parts practice and security practice collide. A cold spare pulled from a shelf in 2027 will ship with whatever image it had when it was boxed. If that image predates the fix, swapping it in during an outage reintroduces the CVE at the worst possible moment — with the added complication that nobody is watching the network while the team is restoring service.
Three habits reduce that risk. Keep a patched golden image for each device family, and record its build string alongside the part number. Label physical spares with the firmware they carry, and update them on a schedule rather than on failure. And when a device is swapped, re-apply the hardening baseline — management access lists, logging destinations and disabled services — because a replacement unit arrives with defaults.
The same logic applies to the surrounding hardware. Managed switches such as the Siemens 6GK5206 6-port managed IE switch, the 6GK5208 8-port managed switch or the 6GK5408 24-port modular switch are the devices that enforce a segmentation plan, and they are also devices with their own firmware cadence. If you maintain a spare shelf, the Ethernet switch range and the communication module range are the two places where a stale image does the most damage.
For substation and process installations, the same rule applies to the modules that connect protection and control equipment to the network: an ABB CI868K01 IEC 61850 communication module or a Siemens CP 443-1 communications processor is a natural pivot point if its configuration is not controlled. Keep the configuration file versioned with the firmware, not instead of it.
Power and I/O hardware is usually outside a CVE cycle, but it belongs in the same maintenance window because that is when the work actually happens. A 24 V DC 20 A supply such as the ABB SD834 or an ABB 560PSU02 for RTU560 subracks is the kind of item that turns a two-hour firmware window into a six-hour outage if it fails on restart. The same is true of the field-side modules on the same rack, from an RTU560 analogue input module to a ProSoft PLX32-EIP-PND gateway that bridges two protocol domains.
Frequently asked questions
Are the 29 October 2026 ICS advisories being actively exploited?
None of the four CVEs — CVE-2026-89209, CVE-2026-10756, CVE-2026-106087 and CVE-2026-13162 — appears in CISA's Known Exploited Vulnerabilities catalog as of 30 October 2026. CVE-2026-43284, the kernel flaw in the CoreTec advisory, is also not listed. The related Fragnesia bug, CVE-2026-46300, was added to KEV on 28 October, so the neighbourhood is active even though these specific entries are not.
What is the fastest fix for the Siemens Mendix SAML issue?
If you can release an application update, move to Mendix SAML 4.2.4 for Mendix 10 or 11 builds, or 3.6.29 for Mendix 9 builds. If you cannot, disable IdP-initiated SSO. Siemens lists that as the mitigation, and service-provider-initiated login is unaffected, so most users see no change.
Which TRO600 version should I update to?
The advisory names 9.2.2.1 as the update target and states that 9.1.2.0 is fixed. Because both of those values also appear in the affected-version line, confirm the exact build with Hitachi Energy PSIRT and record what the device reports before closing the ticket.
Is there a fix for CoreTec4?
Not in this advisory. CoreTec4 at 3.4.0 or earlier is listed as affected, and the only remediation named is CoreTec5 5.0.0. Operators still on CoreTec4 need compensating controls now and an upgrade or replacement decision this budget cycle.
Why does a Linux kernel vulnerability appear in an OT advisory?
Because the device runs embedded Linux. CVE-2026-43284 is a write-what-where condition in the kernel's IPsec ESP handling that lets a local user escalate to root. On an appliance, a local user usually means anyone who has already reached a web interface or a low-privileged account, which is why the fix arrives as a new device image rather than a patch file.
Do any of these advisories require hardware replacement?
No. All four CVEs are addressed by software or firmware updates, with the exception of CoreTec4, where no fixed version is listed. Budget conversations about CoreTec4 concern lifecycle, not a recall.
Sources
CISA, ICSA-26-302-01, Siemens Mendix SAML Module, 29 October 2026 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01
CISA, ICSA-26-302-02, Hitachi Energy TRO600 series products, 29 October 2026 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-02
CISA, ICSA-26-302-03, Hitachi Energy CoreTec Product, 29 October 2026 — https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03
CISA, Known Exploited Vulnerabilities Catalog, version 2026.10.29 — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Hitachi Energy, TXpert Ecosystem (TXpert Hub monitoring system powered by CoreTec) — https://www.hitachienergy.com/products-and-solutions/transformers/the-txpert-ecosystem
ASUS IoT, TRO610 cellular router developed with Hitachi Energy — https://iot.asus.com/
Talk to us
If you are working through this release and need a module, switch, power supply or communication card to complete a maintenance window, tell us the part number and the build you need. We keep Siemens, ABB and Honeywell stock alongside the rest of the catalogue, and we can match a spare to the firmware baseline you are running. Start with the power supply range or send the details through our contact form.
