Secuno
ENNL
Book demo

CVE-2026-2460

Hitachienergy Reb500 Firmware vulnerability

8.1 HIGHEPSS 0.29%
  1. Published24 Feb 2026

Description

A vulnerability exists in REB500 for an authenticated user with low-level privileges to access and alter the content of directories by using the DAC protocol that the user is not authorized to do so.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Hitachienergy Reb500 Firmware< 8.3.3.1

Remediation

Fixed in
Hitachienergy Reb500 Firmware≥ 8.3.3.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-966599.1
A flaw was found in Foreman. This vulnerability allows an authenticated user with…
CVE-2026-189518.8
A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator.…
CVE-2026-100909.0
A flaw was found in the Application Subscription controller…
CVE-2026-424068.7
A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged,…
CVE-2026-296469.8
In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension)…
CVE-2026-273148.8
Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using…

Frequently asked

Is CVE-2026-2460 being actively exploited?

CVE-2026-2460 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.29%.

How severe is CVE-2026-2460?

CVE-2026-2460 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.29% probability of exploitation.

Which products are affected by CVE-2026-2460?

Affected products include Hitachienergy Reb500 Firmware.

How do I fix CVE-2026-2460?

Upgrade affected software to a fixed version, for example Hitachienergy Reb500 Firmware 8.3.3.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-2460 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.