---
id: CVE-2026-8066
title: >-
  A directory traversal vulnerability in the file upload functionality of
  Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker
  to write or overwrite arbitrary files on the device file system
summary: >-
  A directory traversal vulnerability in the file upload functionality of
  Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker
  to write or overwrite arbitrary files on the device file system. Depending on
  the files…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-23
vendor: Hitachi Energy
product: RTU500 series CMU firmware
affected:
  - rtu500_series_cmu_firmware >= 9.0 < 12.0
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T21:39:02.570'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8066'
references:
  - url: >-
      https://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch
    label: cybersecurity@hitachienergy.com
tags:
  - nvd
  - cve.org
epss: 0.00736
epssPercentile: 0.54266
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-29T15:52:09.514722Z'
ingestedAt: '2026-09-29T09:30:49.083Z'
---

## Overview

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.