Operators running Hitachi Energy's CoreTec5 or CoreTec4 should update to CoreTec5 version 5.0.0, which the advisory lists as the vendor fix for two vulnerabilities in the energy-sector product.
The advisory, published October 29, covers CoreTec5 versions 3.4.0 and earlier and CoreTec4 versions 3.4.0 and earlier. Its summary also lists 5.0.0 among the affected CoreTec5 versions, even though the remediation sections name 5.0.0 as the fix, so operators should confirm the exact build with the vendor.
The first flaw, CVE-2026-13162, is an OS command injection (a bug that lets an attacker smuggle system commands into input the software trusts). It sits in the configuration daemon's time synchronization handler, which sets the system timezone. The daemon builds a shell command by joining user-supplied input without sanitizing it. An authenticated user with certain roles can run arbitrary commands with full control of the device. It is scored 7.5 on CVSS 3.1 and 7.7 on CVSS 4.0. It affects both CoreTec5 and CoreTec4.
The second, CVE-2026-43284, is a Linux kernel bug in the IPsec ESP subsystem that the advisory calls Dirty Frag. A crafted network packet makes the kernel decrypt data into memory pages it does not own, including cached copies of privileged system binaries. When one of those binaries runs, the attacker's code runs as root. In CoreTec5 the vulnerable component is built into the kernel and present at boot. It scores 8.8 on CVSS 3.1, the highest rating in the advisory, and affects CoreTec5 only.
Neither flaw is listed as exploitable by an anonymous outsider. One needs a logged-in account with the right role, the other needs local access. That narrows the risk to stolen credentials, insiders, or a device already breached, but those are the footholds that matter in industrial networks. The advisory does not say the two can be chained.
CoreTec4 owners get the harder deal: the listed fix is an upgrade to CoreTec5, not a CoreTec4 patch. The advisory says researchers in the cybersecurity research group at Hitachi India R&D Center reported the flaws to the US cybersecurity agency. Beyond the upgrade, the only mitigation listed is general guidance: keep control systems off the internet and behind firewalls. Sites that cannot move to 5.0.0 soon are left relying on network isolation alone.