Skip to content
OpenAdvisories
High ICSA-26-302-03 2 CVEs

Hitachi Energy CoreTec Product

Published Oct 27, 2026 · Updated Oct 29, 2026 · Revision 2

Vendor: Hitachi Energy Product: CoreTec4 Product: CoreTec5

Summary

Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

Vulnerabilities 2

  • High 8.8
    CVE-2026-43284 Public exploit EPSS 94%

    xfrm: esp: avoid in-place decrypt on shared skb frags

    In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.7
    CVE-2026-13162

    An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arb…

    Hitachi Energy CoreTec 4 CoreTec 5 ICS / OT

Revision history

  1. #2

    Initial CISA Republication of Hitachi Energy PSIRT 8DBD000258 advisory

  2. #1

    Initial public release

References