CVE-2026-2459
CVE-2026-2459 is a high-severity vulnerability in Hitachienergy Reb500 Firmware with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-267.
Key facts
- Severity: High (CVSS 3.x base score 8.1)
- CVSS v4: 7.4
- EPSS exploit prediction: 0% (25th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-8463
- Weakness: CWE-267
- Affected product: Hitachienergy Reb500 Firmware
- Published:
- Last modified:
Description
A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.
Frequently asked questions
- What is CVE-2026-2459?
- A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so.
- How severe is CVE-2026-2459?
- CVE-2026-2459 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
- Is CVE-2026-2459 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-2459?
- CVE-2026-2459 affects Hitachienergy Reb500 Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-2459?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2026-2459 have an EU (EUVD) identifier?
- Yes. CVE-2026-2459 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8463.
- When was CVE-2026-2459 published?
- CVE-2026-2459 was published on 2026-02-24 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:hitachienergy:reb500_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Hitachienergy Reb500 Firmware
- CVE-2026-2460 — High (CVSS 8.1): A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of…
- CVE-2021-27196 — High (CVSS 7.5): Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion…
- CVE-2022-3353 — Medium (CVSS 5.9): A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An…
All CVEs affecting Hitachienergy Reb500 Firmware →
Other CWE-267 vulnerabilities
- CVE-2023-22647 — Critical (CVSS 9.9): An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing…
- CVE-2026-29646 — Critical (CVSS 9.8): In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to…
- CVE-2021-44547 — Critical (CVSS 9.1): A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed…
- CVE-2026-27314 — High (CVSS 8.8): Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user with…
- CVE-2025-14349 — High (CVSS 8.8): Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software…
- CVE-2026-0945 — High (CVSS 8.8): Privilege Defined With Unsafe Actions vulnerability in Drupal Role Delegation allows Privilege Escalation.This issue…