High severity · published Oct 27, 2026
CVE-2026-106087
TRO600 contains an arbitrary file read vulnerability
New
8.7
CVSS
–
EPSS
No
On KEV
Description
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
TRO600 Series Firmware · Hitachi Energy
9.0.0.0 through 9.1.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106087
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106087
publisher.hitachienergy.com
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000224&LanguageCode=en&DocumentPartId=&Action=Launch
More from TRO600 Series Firmware
7.7
CVE-2026-10756
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost
