Owners of Hitachi Energy TRO600 devices running version 9.2.1.6 or earlier, or 9.1.1.0 or earlier, should update now. The vendor's fix is version 9.2.2.1, and 9.1.2.0 for the older branch.
The advisory covers two vulnerabilities. The more serious in practice, CVE-2026-106087, is an arbitrary file read. An attacker with no login can read or download files from the device, including configuration files and password data. It scores 7.5 under CVSS 3.1 and 8.7 under the newer 4.0 version. CVSS is a 0-to-10 severity scale, and the vector strings list low attack complexity and no privileges required.
The second, CVE-2026-10756, needs an attacker who is already authenticated. That person can bypass network restrictions and use port forwarding to reach services meant to be available only from the device itself. The advisory says this can expose sensitive functionality and confidential information and affect availability. It scores 7.5 under 3.1 and 7.7 under 4.0, with high attack complexity. The 9.1 branch is listed only for the file-read flaw.
The two scores look alike, but they describe different risks. Our reading, not the advisory's: the file-read bug could supply the credentials the second one demands, which would turn a login-required flaw into a plausible follow-on step. The advisory does not say the two have been chained.
The summary also says the flaws can enable remote code execution, yet neither CVE description spells out that outcome. Hitachi Energy's internal team reported both, and the advisory does not mention exploitation in the wild. CISA republished the vendor's text unchanged on October 29, after Hitachi Energy's initial release on October 27.
The devices are deployed worldwide in the energy sector. That makes the standard advice carry weight: keep them off the internet, behind firewalls, and reachable only through updated VPNs. An unauthenticated file read is the kind of flaw that punishes a device exposed to the internet, which is the situation that advice exists to prevent.