Hitachi Energy CoreTec: OS cmd inj

Linux kernel

Hitachi Energy CoreTec product vulnerable to OS command injection and Dirty Frag attacks, affecting confidentiality, integrity, and availability.

Do this now

Upgrade Linux to 7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.171, 5.15.205 or 5.10.255, matching your release line.

Fix it

CoreTec 5

Fix not named in the CVE record: see vendor advisory

CoreTec 4

Fix not named in the CVE record: see vendor advisory

Linux

On 5.10.xUpgrade to Linux 5.10.255
On 5.15.xUpgrade to Linux 5.15.205
On 6.1.xUpgrade to Linux 6.1.171
On 6.6.xUpgrade to Linux 6.6.138
On 6.12.xUpgrade to Linux 6.12.87
On 6.18.xUpgrade to Linux 6.18.28
On 7.0.xUpgrade to Linux 7.0.5
On 4.11.xNo fix on 4.11.x yet

Fixed for Linux; still cooking for CoreTec 5 and CoreTec 4.

First seen: 29 Oct 2026
Last update: 29 Oct 2026, 15:20 UTC
Fixed in: 7.0.5
6.18.28
6.12.87
6.6.138
6.1.171
5.15.205
5.10.255
Identifiers: CVE-2026-13162
CVE-2026-43284
CVSS: 8.8
Source: news
On the menu as: Linux kernel

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Hitachi Energy CoreTec: OS cmd inj
Severity: high. Patch status: partial fix.
Affected: Linux kernel
Fixed in: 7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.171, 5.15.205, 5.10.255
Ids: CVE-2026-13162, CVE-2026-43284

Hitachi Energy CoreTec product vulnerable to OS command injection and Dirty Frag attacks, affecting confidentiality, integrity, and availability.

## Steps
1. This touches infrastructure (linux). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: Linux: 7.0.x → 7.0.5; 6.18.28; 6.12.87; 6.6.138; 6.1.171; 5.15.205; 5.10.255; 4.11.x → no fix on 4.11.x yet. CoreTec 5 <= 5.0.0; CoreTec 4 <= 3.4.0: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| CoreTec 5 <= 5.0.0 | not named in the CVE record | check the vendor advisory | restrict network access to it |
| CoreTec 4 <= 3.4.0 | not named in the CVE record | check the vendor advisory | restrict network access to it |
| Linux 7.0.x | fixed | 7.0.5 | — |
| Linux | fixed | 6.18.28 | — |
| Linux | fixed | 6.12.87 | — |
| Linux | fixed | 6.6.138 | — |
| Linux | fixed | 6.1.171 | — |
| Linux | fixed | 5.15.205 | — |
| Linux | fixed | 5.10.255 | — |
| Linux 4.11.x | migrate | move to 5.10.255 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-13162") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-03
https://pwned.coffee/i/hitachi-energy-coretec-os-cmd-inj

Timeline

29 Oct 2026, 15:20 UTC
Fix status: unknown → partial fix.
29 Oct 2026
First reported.

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-43284 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
CoreTec 5 <= 5.0.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 29 Oct
CoreTec 4 <= 3.4.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 29 Oct
Linux 7.0 to before 7.0.5 7.0.5 NVD checked 29 Oct
Linux before 6.18.28 6.18.28 NVD checked 29 Oct
Linux before 6.12.87 6.12.87 NVD checked 29 Oct
Linux before 6.6.138 6.6.138 NVD checked 29 Oct
Linux before 6.1.171 6.1.171 NVD checked 29 Oct
Linux before 5.15.205 5.15.205 NVD checked 29 Oct
Linux before 5.10.255 5.10.255 NVD checked 29 Oct
Linux = 4.11 no fix on 4.11.x yet CVE record (CNA) checked 29 Oct
Score: CVSS 8.8 (high). CVSS 3.1 8.8 (CNA Linux) for CVE-2026-43284
Last checked: 30 Oct 2026, 00:18 UTC

Product	Affected	Fixed in	Source
CoreTec 5	<= 5.0.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 29 Oct
CoreTec 4	<= 3.4.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 29 Oct
Linux	7.0 to before 7.0.5	7.0.5	NVD checked 29 Oct
Linux	before 6.18.28	6.18.28	NVD checked 29 Oct
Linux	before 6.12.87	6.12.87	NVD checked 29 Oct
Linux	before 6.6.138	6.6.138	NVD checked 29 Oct
Linux	before 6.1.171	6.1.171	NVD checked 29 Oct
Linux	before 5.15.205	5.15.205	NVD checked 29 Oct
Linux	before 5.10.255	5.10.255	NVD checked 29 Oct
Linux	= 4.11	no fix on 4.11.x yet	CVE record (CNA) checked 29 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

cisa.gov: Hitachi Energy CoreTec Product

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee