Summary
- Two high-severity Linux kernel flaws (CVE-2026-43284 and CVE-2026-43500) affect Hitachi Energy APM Edge versions 6.10 and prior.
- Both vulnerabilities allow a local unprivileged user to escalate privileges to root by corrupting cached OS binaries through crafted network packets.
- CVSS scores are 8.8 and 7.8 respectively — both rated HIGH under CVSS v3.1.
- Hitachi Energy’s recommended immediate mitigation is to disable the affected kernel modules: esp4, esp6, and rxrpc.
- No patch details are provided in the advisory; organisations should contact Hitachi Energy directly for remediation guidance.
What has been disclosed
CISA published an ICS advisory on 13 August 2026, republishing Hitachi Energy’s own PSIRT notice (8DBD000256) covering two vulnerabilities collectively referred to as ‘Dirty Frag.’ Both flaws reside in the Linux kernel as shipped with APM Edge, Hitachi Energy’s asset performance management platform deployed across the energy sector worldwide. All APM Edge versions up to and including 6.10 are confirmed affected.
The first flaw: CVE-2026-43284
This vulnerability (CVSS 8.8, HIGH) sits in the IPsec ESP subsystem — specifically the esp4 and esp6 kernel modules. The flaw concerns how the kernel handles memory pages when decrypting ESP-encapsulated network packets. An attacker who can craft a suitable packet causes the kernel to write decrypted data into memory pages it does not own, potentially overwriting cached copies of privileged operating system binaries. When those binaries are subsequently executed, any code injected by the attacker runs with root privileges. In APM Edge, any local user can load the vulnerable esp4 and esp6 modules, which makes the exploitation path accessible without elevated permissions from the outset.
The second flaw: CVE-2026-43500
The second vulnerability (CVSS 7.8, HIGH) affects the RxRPC protocol implementation in the Linux kernel. The mechanism is comparable: during packet processing, the kernel writes decrypted data directly into memory pages it does not own, including cached copies of privileged OS binaries. Execution of a corrupted binary again results in attacker code running as root. As with the first flaw, the rxrpc kernel module can be loaded by any local user on APM Edge. The out-of-bounds write (CWE-787) classification reflects the slightly different memory handling path involved.
Context and discovery
Hitachi Energy’s internal security team identified and reported both vulnerabilities to CISA. There is no indication in the advisory of active exploitation or public proof-of-concept code at the time of publication. The advisory does not specify whether a patched firmware or software version is available; organisations requiring that information are directed to contact Hitachi Energy PSIRT directly.
Deployment scope
APM Edge is described as deployed worldwide across the energy critical infrastructure sector, with Hitachi Energy headquartered in Switzerland. Given this deployment footprint, the advisory is relevant to asset-intensive energy operators — utilities, generation facilities, and network operators — wherever APM Edge is in service.
Why it matters
APM Edge sits on operational technology networks in the energy sector, where local access — whether through a compromised user account, a malicious insider, or lateral movement from a business network — translates directly into a potential root-level compromise of an industrial asset management platform. A root-level attacker on a system of this kind can tamper with asset data, disable monitoring, or pivot further into the OT environment. The attack surface is not trivially small: because any local user can load the vulnerable kernel modules, there is no elevated-permission precondition standing between a foothold and full system control. Energy sector CISOs should treat this as a concrete risk management task rather than a theoretical concern.
What to do now
- Identify all APM Edge deployments at version 6.10 or earlier in your environment.
- Disable the esp4 and esp6 kernel modules on affected APM Edge instances as an immediate mitigation for CVE-2026-43284.
- Disable the rxrpc kernel module on affected APM Edge instances as an immediate mitigation for CVE-2026-43500.
- Contact Hitachi Energy PSIRT directly (via hitachienergy.com/contact-us) to obtain remediation guidance and any available patched versions.
- Ensure APM Edge systems are isolated from direct internet access and separated from business networks by firewalls with minimal exposed ports.
- If remote access to APM Edge is required, use a current, patched VPN solution rather than direct connectivity.
- Review and restrict local user accounts on APM Edge systems to limit the pool of users who could load kernel modules.
- Follow established internal incident procedures and report any suspected malicious activity to CISA for tracking.
