CVE WatchSep 29, 2026

CVE-2026-8067

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the

CVSS

6.5

Medium

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Published: Sep 29, 2026 · Last modified: Sep 29, 2026 · CWE-862

EPSS · 30d

0.2%EPSS · 30 days0.3%

2026-09-292026-10-25

Technical description

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

Official references

publisher.hitachienergy.comhttps://publisher.hitachienergy.com/preview?DocumentID=8DBD000251&LanguageCode=en&DocumentPartId=&Action=Launch

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1159725.3 MED

19.8%

——6A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthController.php. Executing a manipulation of the argument id/status can lead to missing authorization. The attack can be launched remotely. The vendor was contacted early about this disclosure.2d CVE-2026-1141926.5 MED

12.3%

——4Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.2d CVE-2026-1141917.5 HIG

26.7%

——8Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.2d CVE-2026-1160084.3 MED

9.2%

——3DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications.2d CVE-2026-1147056.5 MED

12.9%

——4Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.2d CVE-2026-1159757.1 HIG

11.8%

——4Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects2d