The Cybersecurity and Infrastructure Security Agency (CISA) republished a Hitachi Energy advisory, ICSA-26-279-05, on Sept. 29, 2026. It covers open-source software vulnerabilities in the company’s REB500 product that, according to the advisory, can be exploited to cause a denial-of-service condition.
A denial-of-service condition means a device or system stops responding or becomes unavailable to its users. The advisory does not describe how that would play out at a given site, so this brief does not speculate on physical effects.
The advisory lists REB500 versions 8.3.3.1 and earlier as affected and ties them to CVE-2024-8176 and CVE-2025-59375 (Common Vulnerabilities and Exposures identifiers). It names the Energy sector, worldwide deployment and a company headquarters in Switzerland.
Patch status and exploitation
The advisory text provided does not name a fixed REB500 version for either CVE. It refers readers to Recommended Immediate Actions without giving them. CISA says the notice is a verbatim republication of Hitachi Energy PSIRT advisory 8DBD000247, disclaims responsibility for its accuracy and directs questions to Hitachi Energy PSIRT, the company’s product security team.
The advisory’s SSVC line, a triage scheme for prioritizing vulnerabilities, records exploitation as none. The text provided reports no exploitation in the wild, and it does not address service disruption.
Mitigation guidance in CISA's republication
CISA’s republication recommends keeping control systems off the internet, placing them behind firewalls and isolating them from business networks. Where remote access is required, it recommends VPNs (virtual private networks), which it says should be kept updated.
Why it matters
Hitachi Energy’s internal team reported the vulnerabilities to CISA, according to the advisory. For utilities running REB500, the republished text establishes which versions and CVEs are involved, and that no exploitation is recorded.
What it does not establish is whether a fix exists for versions 8.3.3.1 and earlier. Under CISA’s republication, that answer sits with Hitachi Energy PSIRT.
Join the discussion