CISA listed EOL Hitachi RTU500. Thursday’s 9.8 is openPDC. The campaign is Integrity Tech, not a PLC.

2–9 October 2026. ICSA-26-279-06 is unauthenticated firmware on RTU500 CMU 11.x and prior — Dragos, no 11.x patch, migrate 12.7.8 / 13.9.1. Same Tuesday pack: SOI ActiveMQ Jolokia 8.8, Asset Suite servlets, REB500 libexpat, lwIP SMTP 9.8 as a git commit, EasyIO FG EOL with no firmware. Thursday: GPA openPDC / openHistorian deserialization 9.8 (fix 2.9.482 / 2.8.585), Red Lion N-Tron 700 to 3.11.1, Satel Netco Design 2.1.7. AA26-281A is Exchange, SoftEther, and five old KEV rows — a scanned power company is not a process write.

RWP Ventures · 2026-10-09 · 18 min read · priority 8.6

The finding that belongs at the top of an energy OT queue is not last week’s Toptech TMS7. On 6 October CISA republished Hitachi Energy PSIRT 8DBD000251 as ICSA-26-279-06. Product: RTU500 series CMU — the communications module on a field remote terminal unit. Reporter: Dragos. Affected: firmware 11.x and prior (EOL). Headline new CVE CVE-2026-8065: missing authentication on the firmware-update endpoint (CWE-306). Unauthenticated crafted POST, arbitrary firmware. Hitachi CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). Same advisory: unauthenticated path traversal CVE-2026-8066 (also 9.1), authenticated reboot CVE-2026-8067 (6.5), plus leftover CVE-2010-2965 VxWorks WDB (CISA table 9.8), CVE-2014-9195, CVE-2023-46143. There is no 11.x patch. The close is a supported train: 12.7.8 or 13.9.1 or later. SSVC on the vendor note is E:N. Not on KEV.

Do not brief the CISA 9.8 header as the new firmware bug. That score is WDB. 8065 is 9.1. Do not brief CERT-Bund’s <12.7.8 product bound as a new vulnerable range; the ICSA and CVE record are 11.x / before 12.0. Supported trains are out of this advisory.

Thursday’s energy-software 9.8 is a different ticket. ICSA-26-281-02 is Grid Protection Alliance openPDC and openHistorian. CVE-2026-100730: the service console deserializes a client-supplied structure. Without Windows Authentication, CISA scores it 9.8 (PR:N). With Windows Authentication, the attacker is already logged on. Fix: openPDC 2.9.482 / openHistorian 2.8.585. Same advisory: unauthenticated internal publisher (CVE-2026-105281, 7.5) and STTP publisher (CVE-2026-85479, 5.3) that bind off-loopback on upgraded installs; Modbus SSRF CVE-2026-101022 (4.3, workaround only); unsafe reflection CVE-2026-104629 (8.8, PR:L, floor 2.9.477 / 2.8.580); Docker hardcoded admin CVE-2026-105278 (9.8) with no fix planned — GPA does not recommend the published Docker image in production. Shubham Raj (Cipher), Causal Security, reported the set. No known public exploitation.

The only CONFIRMED in-the-wild activity with a 2–9 October timestamp that OT operators should treat as a live ticket is not a PLC. On 8 October CISA/FBI/NSA and six partners published AA26-281A on China-based Integrity Technology Group. DOJ seized MicroScan and FishHub. Appendix B lists eight successfully exploited CVEs; five went on KEV the same day, federal due 11 October. Persistence in the CSA is SoftEther named conhost.exe / dllhost.exe. DOJ names a South Carolina power company as a scan target. Chris Butera’s press line about PRC actors in OT is a general positioning statement. It is not a finding in this CSA that Integrity Tech wrote a PLC. [9 October Daily Top](/posts/2026-10-09-integrity-tech-aa26-281a-kev/).

Same week’s edge KEVs that remain IT-to-OT doors: Citrix NetScaler CVE-2026-88779 (KEV 4 October, FCEB due 7 October, SAML overflow), FortiMail CVE-2026-104286 (due 4 October; confirm the ISO), and [FortiBleed lockouts](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/) that FBI/USSS say are still taking admin sessions.

Do not upgrade this week’s ICSA pile into FrostyGoop. Last week’s live OT threat is unchanged: internet-reachable PLCs and engineering-client abuse named in AA26-097A and AA26-231A. CVE-2026-3869 on M580 / M580 Safety still has no CISA ICSA as of 9 October morning; SEVD-2026-251-04 remains the primary. Hitachi FACTS FCP/GWS still has no versioned patch in the 17 September ICSA.

OT threat posture

Exposure, engineering-path abuse, and a KEV’d ADC/VPN remain higher confidence than novel ICS malware. Ransomware still hurts plants by killing the Windows, mail, and hypervisors OT depends on. Integrity Tech this week is email, credentials, leftover ProFTPD/Struts/GitLab/Pulse, and a SoftEther client — CONFIRMED as CNE against IT that critical-infrastructure operators run, not confirmed as a process write. No public primary source this week documented a new ladder-logic change or a new ICS-specific wiper.

1. Most significant development

Hitachi Energy RTU500 CMU CVE-2026-8065, because CISA put Dragos’s unauthenticated firmware-upload finding on the ICS list against an energy-sector field RTU communications module whose only close is a supported-train migration.

Why this outranked the rest of the week: GPA openPDC 9.8 is the Thursday energy-software ticket — unauthenticated deserialization when Windows Authentication is off, versioned patch the same day — and it would have been the lead in a week without a field RTU. It is still a concentrator/historian on Windows, not firmware on the CMU that already carries telemetry and commands. Integrity Tech is the week’s biggest USG story and scored 9.1 as a Daily Top; it is not the OT lead because the CSA’s confirmed collection is mail and credentials, and the power-company sentence is reconnaissance. Red Lion N-Tron 700 is an industrial Ethernet switch with a versioned 3.11.1 and a CISA table of 8.3. lwIP SMTP 9.8 is a stack component and a Savannah commit, same class as last month’s MQTT. EasyIO FG is local, high complexity, not remotely exploitable, unsold since before 2019. Score for the week: 8.6. GPA-as-lead would have been ~8.4 (9.8, energy historian, versioned fix). Integrity-Tech-as-lead belongs in the IT briefing and in section 2 here.

2. Adversary / campaign activity

CONFIRMED (this window, not ICS malware): AA26-281A, 8 October. Integrity Tech as enabler for China-linked actors; TTP overlap named with Flax Typhoon / Ethereal Panda / Red Juliett, with the CSA’s own not-1:1 caveat. MicroScan (1,300+ scripts) and FishHub seized. SoftEther persistence. EBurst against Exchange. Five new KEV rows due 11 October: ProFTPD CVE-2015-3306, BIND CVE-2015-5477, Struts CVE-2016-3081, ONLYOFFICE CVE-2021-3199, Strapi CVE-2023-22894. Pulse CVE-2019-11510, GitLab CVE-2021-22205, Bash CVE-2014-6278 were exploited in the same appendix and were already on the catalog. DOJ: MicroScan targeting included a South Carolina power company, Japanese and Polish airports, Taiwanese natural-gas and power firms. That is a scan list. Hunt SoftEther named conhost.exe, EBurst on plant Exchange, and leftover Appendix B services. Do not open an ICS incident from a scanned utility.

Continuing, still the current hunt set:

• AA26-097A (April, updated 22 July): Iran-affiliated actors using Studio 5000 / EcoStruxure Control Expert / TIA Portal against internet PLCs (CompactLogix, Micro850, Modicon M340, S7-1200). CONFIRMED as USG. No new victim set this window. WaterISAC’s 8 October members-only Iran sitrep is a continuation flag, not a new public PLC write.
• FBI/EPA 30 July water PSA: MicroLogix 1100/1400, seven states. CONFIRMED as PSA. Not this week’s news.
• AA26-231A (19 August): recon and capability development on US S7-200/300/400/1200. CONFIRMED as USG wording. Now seven weeks old. No new victim set this window.

CONFIRMED (non-ICS, this week): Citrix NetScaler CVE-2026-88779, KEV 4 October, federal due 7 October. FortiBleed admin lockouts, FBI/USSS 8 October. FortiMail CVE-2026-104286 remains KEV after the 4 October due date. Zammad CVE-2026-102489 / 102490, KEV 2 October. Atlassian CVE-2026-21589, 6 October, eight Data Center products, unauthenticated known-file read — IT ticket.

UNKNOWN a 2–9 October named victim with a confirmed ladder-logic, protection-setting, RTU500-firmware, openPDC-console, or N-Tron-config change.

3. Vulnerabilities and active exploitation

CONFIRMED (CISA ICS, 6 October)

CONFIRMED (CISA ICS, 8 October)

CONFIRMED (active exploitation, not ICS): Integrity Tech Appendix B / KEV freeze 2026.10.08 / 1739, due 11 October. NetScaler CVE-2026-88779, KEV 4 October, due 7 October. FortiBleed session lockouts, FBI/USSS 8 October. FortiMail CVE-2026-104286 still KEV after 4 October. Zammad 2 October. Last week’s NetScaler 88771/88772, SD-WAN Manager 76504, and FortiMail 104286 remain the prior-week edge hunt. vCenter CVE-2026-59310 remains KEV with ransomware Known. RTU500 8065, openPDC 100730, and N-Tron 32645 are not on KEV as of this morning.

Still missing from CISA ICS: Schneider CVE-2026-3869 on M580 / M580 Safety. Four-week watch item. As of 9 October morning the ICS index still does not list it. Primary source remains SEVD-2026-251-04 (firmware 4.10+ and application level 4.00 / 4.20). Hitachi FACTS ICSA-26-260-03 still names no patched FCP version.

4. ICS / SCADA impact

No CONFIRMED new loss-of-view or loss-of-control event dated 2–9 October in CISA ICS, Hitachi Energy, GPA, Red Lion, Johnson Controls, or AA26-281A.

What would become process impact, if exploited on an exposed or poorly segmented box:

• RTU500 8065 → unauthorized firmware on the CMU that already sits between field I/O and the control center. That is device integrity on an energy RTU, not a confirmed breaker operation. 8066 is filesystem write. 8067 is an authenticated reboot. WDB on UDP 17185 is leftover memory access on EOL VxWorks.
• openPDC 100730 → code execution in the synchrophasor concentrator / historian service account when the console is reachable without Windows Authentication. That is loss of measurement integrity and a Windows host in the energy DMZ, not a protection-element rewrite.
• SOI Jolokia → RCE as the ActiveMQ broker user on the 800xA integration host. Energy software. Authenticated (PR:L).
• N-Tron 700 → admin on the cell Ethernet switch, config replace, scriptable reboot. Availability of the segment, not ladder logic.
• EasyIO FG → full device if the attacker is already local with a low-priv account and wins a high-complexity path. Building controller, unsold, not remote.
• Integrity Tech against a utility Exchange / GitLab / Pulse → IT compromise at an industrial company. ASSESSED IT-to-OT path if those boxes sit on a path to engineering. Not a process event in this CSA.

Prior water PLC tampering (July) and the UK small-generator outage (late July, disclosed August) remain the last well-sourced availability hits. They are not this week’s news.

5. IT-to-OT exposure

Six doors this week, in the order operators can actually hunt:

1. Integrity Tech SoftEther / Exchange / leftover Appendix B on any box that also talks to engineering. Hunt conhost.exe / dllhost.exe SoftEther, EBurst against plant mail, ProFTPD SITE CPFR, Struts DMI, GitLab 22205, Pulse 11510. Due 11 October on the five new KEV rows. A seized scanner does not uninstall the VPN client. [9 October Daily Top](/posts/2026-10-09-integrity-tech-aa26-281a-kev/).
2. Citrix NetScaler ADC/Gateway that is the plant, contractor, or jump-host VPN. CVE-2026-88779 is the SAML overflow added 4 October, due 7 October — a different row from last week’s 88771/88772 RCEs. Floor 14.1-73.41 / 13.1-64.28. Forensic triage Yes. [5 October Daily Top](/posts/2026-10-05-netscaler-cve-2026-88779-kev/).
3. FortiOS / FortiBleed that still locks admins out. FBI/USSS 8 October: the ISO is not the close if the session was already stolen. [8 October Daily Top](/posts/2026-10-08-fortibleed-fbi-usss-lockouts/).
4. FortiMail that handles plant or engineering mail. CVE-2026-104286, due 4 October. Confirm 8.0.2 / 7.6.7 / 7.4.9 as installable ISOs before retiring the IBE workaround.
5. openPDC / openHistorian management and publisher ports if they answer off the host. 2.9.482 / 2.8.585, then re-bind publishers that an in-place upgrade left on the old wildcard. Docker image is not a production PDC.
6. N-Tron 700 web GUI / SNMP on a plant or contractor VLAN. 3.11.1. Treat an unauthenticated reboot URL as an availability ticket, not as ICS malware.

Ignition, engineering workstations, and internet-facing 44818/102/502/2222 remain the standing hunt from AA26-097A / AA26-231A. That hunt does not reset because CISA listed an EOL RTU.

6. Sector impact

• Electric / transmission: RTU500 CMU 11.x inventory and isolation, then 12.7.8 / 13.9.1. openPDC 2.9.482 / openHistorian 2.8.585, and do not skip the publisher bind check. SOI EP2. Asset Suite servlets off, 9.9.1 when it ships. REB500 8.3.4.0. Last week’s Hitachi FACTS FCP with GWS is still the sector-specific 9.9 and still has no versioned firmware. ABB PCM600 ≤2.14 remains last week’s local protection-engineering ticket. AA26-231A S7 exposure is still the Siemens PLC lead.
• Oil and gas / chemical midstream / bulk liquid: Last week’s TMS7 / TopHAT 7.8 is still the terminal-automation close if 7.6.3 is in. RTU500 if those sites run Hitachi Energy RTUs on the same fence line.
• Process manufacturing: N-Tron 700 to 3.11.1 if that switch is the cell uplink. Copy Fail on Unified HMI / IoT2050 / S7-1500 TM MFP remains the unfixed-in-ICSA Siemens row from September. lwIP SMTP is a supplier letter, same as MQTT was.
• Building / commercial facilities: EasyIO FG is EOL — isolate, do not wait for firmware that will not ship. EasyIO Neo EC/CW to V3.3b64 / V3.3b26 remains last week’s BMS ticket. Desigo CC V6/V7 from September still has no fix.
• Water / food / small SCADA: lwIP SMTP 2.2.1 if a vendor embedded it. Last week’s Lantronix G520 2.6.0.7R6 and mySCADA myPRO Manager 2.2 remain open. Integrity Tech against a utility GitLab or Pulse is an IT ticket until logs show a process write.
• Transportation / EV charging: Last week’s Monta OCPP Security Profile 2 remains the charging-cloud ticket. Satel Netco Design 2.1.7 is radio/network design software, not a vehicle controller.
• Physical security / cameras: Last week’s Armatura One 4.7.2 / 4.6.1_USA and VIVOTEK current firmware remain the PACS/camera tickets. Integrity Tech XSS → live700_v1.exe is an IT workstation path.

7. Defensive priorities

1. Internet-facing PLC eradication — still number one. VPN or jump host, never the controller. AA26-097A / AA26-231A have not been withdrawn.
2. RTU500: inventory CMU firmware including spare and retired-but-powered units. Anything 11.x or earlier — isolate firmware-update HTTP and UDP 17185 today, then plan 12.7.8 / 13.9.1. There is no 11.x hotfix. [7 October Daily Top](/posts/2026-10-07-hitachi-rtu500-cve-2026-8065-eol/).
3. openPDC / openHistorian: 2.9.482 / 2.8.585. Confirm Windows Authentication on the console. Re-bind internal and STTP publishers to loopback on upgraded installs. Do not run the published Docker image.
4. Integrity Tech: hunt SoftEther masquerading as conhost.exe/dllhost.exe, EBurst on Exchange, Appendix B leftover services. Five new KEV rows due 11 October. Seizure ≠ eviction.
5. NetScaler 88779 due 7 October — late if it is still the plant VPN. FortiBleed: ISO plus session hunt. FortiMail: confirm the ISO after 4 October.
6. N-Tron 700 to 3.11.1; web GUI off the plant VLAN; SNMP communities not default.
7. Hitachi same-day pack, separately: SOI EP2, Asset Suite servlets disabled, REB500 8.3.4.0. Do not merge them into one “Hitachi 9.8.”
8. lwIP SMTP: vendor letter for commit 614420f. EasyIO FG: isolate, migrate, no patch.
9. Satel Netco Design 2.1.7 if that engineering tool is in the comms shop.
10. Open from prior weeks: TMS7 7.8, Armatura One 4.7.2, MikroTik 7.24 (CVE-2026-84411, still not KEV), FACTS GWS (no versioned patch), M580 SEVD-2026-251-04 (still no ICSA), mySCADA 2.2, Wärtsilä FOS-Onboard, Desigo CC V6/V7.
11. Do not wait for ICS-specific malware. Dragos already told you ransomware did not need Stage 2.

8. What changed from last week

[Last week (ending 2 October)](/posts/2026-10-02-weekly-ot-toptech-armatura-netscaler/) was CISA’s 29 September seven-pack and 1 October six-pack — Toptech TMS7/TopHAT CVSS 10, Armatura One with KEV’d ActiveMQ, Monta charging cloud with no firmware train, MikroTik 84411, VIVOTEK 10.0 with a public PoC, ABB PCM600 local, EasyIO Neo BMS. The exploited edge box was NetScaler 88771/88772, then SD-WAN Manager, then FortiMail.

This week CISA’s original work is an EOL energy RTU with unauthenticated firmware (Dragos), a 9.8 on a US synchrophasor concentrator/historian with a versioned patch, a Red Lion cell switch to 3.11.1, and a Finnish comms design tool. Tuesday also added SOI ActiveMQ, Asset Suite servlets with 9.9.1 still “when available,” REB500 libexpat, lwIP SMTP as another Savannah commit, and EasyIO FG with no firmware. No new Siemens ProductCERT ICSA this window. CVE-2026-3869 on M580 still has no ICSA. FACTS GWS still has no versioned patch. No new USG PLC campaign update. No new FBI/EPA water PSA. No new industrial-ransomware quarter. The exploited activity moved from NetScaler/FortiMail to Integrity Tech (Exchange, SoftEther, five old KEVs due 11 October), with FortiBleed lockouts still in the FBI ticket and NetScaler 88779’s due date already behind FCEB. AA26-231A is seven weeks old.

9. What OT defenders should watch next

Whether any RTU500 11.x estate that still answers firmware-update HTTP or UDP 17185 shows a version string that moved without a change ticket. Whether CISA adds 8065/8066 to KEV if exploitation against EOL CMUs is confirmed. Whether Hitachi or CERT-Bund reconcile the 11.x / before-12.0 line with WID-SEC’s <12.7.8 bound. Whether Asset Suite 9.9.1 actually ships. Whether openPDC upgrades leave publishers on the old bind, and whether 100730 is ever observed without Windows Authentication. Whether N-Tron 700 reboot URLs show up in plant-switch telemetry. Whether Integrity Tech SoftEther is found on an engineering workstation — that would be an IT-to-OT path, still not a PLC write unless logs show one. Whether CISA finally republishes CVE-2026-3869. Whether Hitachi publishes a versioned FCP/GWS patch. Q3 industrial ransomware counts. Any AA26-097A or water-PSA refresh.

10. RWP assessment

High confidence: this week is CISA’s 6 October Hitachi/lwIP/EasyIO pack plus 8 October GPA/Red Lion/Satel pack — an EOL energy RTU with unauthenticated firmware and no 11.x patch, a 9.8 on openPDC when Windows Authentication is off, and an industrial switch with a 3.11.1 close. High confidence: exposed controllers and engineering paths in AA26-097A / AA26-231A remain the incident class that has evidence. High confidence: Integrity Tech is real CNE against IT that critical-infrastructure operators run, and a scanned power company is not a confirmed process event. Moderate confidence: a non-trivial RTU500 11.x estate is still powered because EOL field firmware is how T&D actually looks. Moderate confidence: NetScaler 88779, FortiBleed, FortiMail, and SoftEther-on-the-jump-host are the IT-to-OT doors that will produce this week’s actual tickets. Low confidence: a new OT malware family dropped in the last seven days. Labeling a manufacturer ransomware victim, an Integrity Tech mailbox dump, an openPDC console, an N-Tron reboot, or a Satel design-tool XSS as “OT compromise” without process evidence remains a briefing error.

This assessment covers 2–9 October 2026 and was published 9 October 2026.