PatchSiren cyber security CVE debrief

CVE-2026-32776 Hitachi Energy CVE debrief

CVE-2026-32776 is a medium-severity vulnerability in Hitachi Energy's RTU500 series CMU Firmware. The vulnerability is caused by a NULL pointer dereference in libexpat before 2.7.5, which can lead to a Denial of Service (DoS) impact. The product is only affected if IEC 61850 functionality is configured. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 5.5, indicating a medium severity. The vulnerability was published on May 26, 2026, and modified on June 4, 2026.

Vendor: Hitachi Energy
Product: RTU500 series CMU Firmware
CVSS: MEDIUM 5.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-26
Original CVE updated: 2026-06-04
Advisory published: 2026-05-26
Advisory updated: 2026-06-04

Who should care

Organizations using Hitachi Energy's RTU500 series CMU Firmware, particularly those with IEC 61850 functionality configured, should be aware of this vulnerability and take necessary precautions. The vulnerability can lead to a Denial of Service (DoS) impact, which can disrupt critical infrastructure operations. CVE-2026-32776 has a CVSS score of 5.5, indicating a medium severity.

Technical summary

CVE-2026-32776 is a NULL pointer dereference vulnerability in libexpat before 2.7.5, which is used in Hitachi Energy's RTU500 series CMU Firmware. The vulnerability occurs when processing empty external parameter entity content, leading to a Denial of Service (DoS) impact. The product is only affected if IEC 61850 functionality is configured. The vulnerability has a CVSS score of 5.5 and a CVSS vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Defensive priority

CVE-2026-32776 has a medium severity and can lead to a Denial of Service (DoS) impact. Organizations using affected products should prioritize patching and mitigation efforts.

Recommended defensive actions

Update to CMU Firmware version 13.8.2
Follow general mitigation factors/workarounds
Update to CMU Firmware version 13.7.9 (when available) or 13.8.2
Monitor and review IEC 61850 functionality configuration
Verify and apply vendor-provided security patches

Evidence notes

The vulnerability is documented in the CVE-2026-32776 record and the National Vulnerability Database (NVD). The source item URL provides additional information on the vulnerability, including affected products and mitigation strategies. The Common Vulnerability and Exposure (CVE) program and the National Institute of Standards and Technology (NIST) provide further details on the vulnerability.

Sources and references

Verified primary and authoritative sources

CVE-2026-32776 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-32776

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-32776 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32776

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-155-04.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-04

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.