Hitachi Energy TRO600 series products

What it is

CISA republished Hitachi Energy PSIRT advisory 8DBD000224 as ICSA-26-302-02 on 27 October 2026. It covers CVE-2026-10756 and CVE-2026-106087 in the TRO600 series. The advisory says they allow remote code execution and disclosure of sensitive information. Hitachi Energy's internal team reported both to CISA.

Preconditions / Affected

Affected versions are TRO600 up to and including 9.2.1.6, up to and including 9.1.1.0, and 9.2.2.1 and 9.1.2.0. The advisory lists the sector as Energy, deployment as worldwide, and the vendor headquarters as Switzerland.

What to do

The page records an SSVC decision point dated 26 October 2026: SSVCv2/E:N/A:N/2026-10-26T14:54:19Z/. In SSVC notation, E:N means no known exploitation and A:N means not automatable. The page does not spell this out. For triage, this points to a scheduled fix rather than an emergency, but the advisory does not say so.

The summary refers readers to a "Recommended Immediate Actions" section for remediation. That section is not in the republished text, and the page gives no fixed version or patch. To find the fix, contact Hitachi Energy PSIRT or your Hitachi Energy service organization and cite 8DBD000224.

Until then, the page offers only general ICS hardening:

• Keep devices off the internet.
• Put control networks behind firewalls, separate from business networks.
• Use VPNs for remote access, and keep the VPNs updated.

Caveats

CISA states that the page is a verbatim conversion of the vendor's CSAF advisory and that it takes no responsibility for its accuracy. The "Vulnerabilities" heading is empty, so the page gives no per-CVE description, CVSS score or attack vector. The affected-version list is also ambiguous, since it mixes upper bounds with two exact versions (9.2.2.1 and 9.1.2.0). Confirm the exact ranges with the vendor.