LiveThreat Vulnerability Brief — CVE‑2026‑2459 / CVE‑2026‑2460 (Hitachi Energy Relion REB500)
What It Is — Two privilege‑escalation flaws in Hitachi Energy’s Relion REB500 controller (versions ≤ 8.3.3.0). An authenticated user assigned the Installer role can read and overwrite files in directories outside its authorization scope. Exploitability — Requires a valid account with the Installer role; no public PoC, but the vendor confirms the issue is exploitable. CVSS v3 6.8 (High).
Affected Products — Hitachi Energy Relion REB500 product, all firmware releases up to 8.3.3.0.
TPRM Impact — Utilities, grid operators, and third‑party service providers that embed REB500 in their SCADA/ICS environments inherit a supply‑chain risk: a compromised installer account could tamper with control‑system binaries, leading to operational disruption or data manipulation.
Recommended Actions — 1️⃣ Deploy Hitachi Energy’s patch (firmware 8.3.3.1) immediately. 2️⃣ Disable or tightly restrict the Installer role until the update is applied. 3️⃣ Enforce least‑privilege IAM policies and network segmentation for REB500 devices. 4️⃣ Enable audit logging and monitor for anomalous file‑system activity. 5️⃣ Validate firmware integrity via signed hashes. Source: CISA Advisory ICS‑A‑26‑062‑02