Two flaws, different access requirements
Hitachi Energy recommends TRO600 version 9.2.2.1 for vulnerabilities affecting its energy-sector communications equipment. CISA republished the vendor’s advisory on October 29. Its detailed findings distinguish unauthenticated file access from a separate weakness requiring an authenticated attacker.
Information exposure and service reachability
CVE-2026-106087 permits access to files that can include configuration and password data. CVE-2026-10756 concerns bypassing network restrictions to reach services intended only for local access, with possible confidentiality and availability consequences. The distinction matters: describing both simply as remote-code-execution bugs obscures the prerequisites documented for each.
A shared recommended destination
The advisory lists 9.1.2.0 as a fix for the file-reading issue but recommends 9.2.2.1, which also addresses the network-restriction flaw. Both the installed branch and the specific issue matter.
Evidence of risk, not an incident report
CISA identifies the material as a republication of Hitachi Energy’s findings, not an independent investigation. It does not establish an exploited utility incident. The news for energy operators is a concrete firmware remediation path.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
