CISA republished Hitachi Energy’s advisory on September 17, 2026, but the vendor’s original advisory, 8DBD000229, was issued on July 28. The timing matters: this is not the first public appearance of the underlying CVE identifiers. The same cluster was previously disclosed for other Hitachi Energy products using GWS-related software. What is new for operators is Hitachi’s confirmation that the vulnerabilities also apply to FACTS Control Platform systems deployed from 2020 onward, provided the GWS component is installed.
That scope is narrower than a headline saying “FCP is vulnerable,” but it is also more operationally difficult. A version inventory alone will not settle exposure. Administrators need to establish whether each installed FCP system includes GWS, then map that component decision to the software versions and the actual network paths into the control environment.
The exposure is tied to GWS, not every FCP deployment
Hitachi Energy lists FCP 3.4.0, 3.7.0, 3.8.0, 3.10.0, 3.12.0, 3.14.0, 3.15.0, 4.0.0, 4.0.1, 4.1.0, and 4.1.1 as affected. But the company explicitly says those version designations apply only where GWS is present. FACTS control deployments without GWS are not affected by this advisory.
The distinction should change the first response. An OT team should not treat a broad FCP estate as one homogeneous patching target, nor should it decide that a system is safe because an operator does not recognize GWS as a separately managed product. In industrial environments, gateway, web-service, and engineering components may have been included as part of an original delivery, modified during a site expansion, or maintained under vendor service arrangements rather than ordinary enterprise software-management processes.
The affected systems include SVC Light STATCOM, Fixed Series Capacitor, Thyristor Controlled Series Capacitor, Static Var Compensator, Static Watt Compensator, and Hybrid Synchronous Condenser installations. These are flexible AC transmission system deployments: equipment and controls used to support voltage regulation, reactive-power management, transmission capacity, and grid stability. The advisory does not say that exploitation can directly issue process commands or cause a grid event. It does say the flaws can affect confidentiality, integrity, and availability of the product, which is enough to make a compromised control-system server a serious operational concern.
Hitachi’s published scope begins with deployments from 2020, not merely versions released in 2020. That wording leaves an important practical question unanswered: whether an older installation that was later upgraded or retrofitted with GWS falls inside the affected population. The vendor directs customers to their product provider or Hitachi Energy service organization for remediation details, so sites with long-lived installations should seek a written applicability determination rather than infer safety from commissioning date alone.
Five flaws carry very different attack conditions
The vendor assigns a maximum CVSS v3 score of 9.9 to the advisory as a whole. The five vulnerabilities should not, however, be treated as a single unauthenticated remote takeover path.
CVE-2024-4872 is an improper-neutralization flaw in data-query logic. Hitachi’s advisory says an authenticated attacker could inject code toward persistent data. CVE-2024-3980 is a path-traversal vulnerability that can allow an authenticated user to access or alter system files or application-critical files.
Those two critical-rated issues make credential protection a first-order control. If an attacker acquires a legitimate GWS account through phishing, password reuse, a compromised engineering workstation, or another intrusion route, application-layer authorization is no longer a sufficient boundary. In practical terms, the immediate review should include which GWS accounts exist, whether any shared or dormant accounts remain, how credentials are stored, and whether access is limited to jump hosts that are monitored.
CVE-2024-3982 requires local access and administrator-level ability to enable session logging. Hitachi says the issue could then be used in an attempt to hijack an established session. Its prerequisites make it less exposed than the data-query and path-traversal flaws, but it is relevant after an attacker has already reached an engineering or server host.
CVE-2024-7940 deserves special attention because Hitachi describes a service intended for local use that is exposed on all network interfaces without authentication. The vendor’s advisory rates it High at 8.3, with attack complexity and user interaction requirements. NIST’s National Vulnerability Database, however, currently assigns the same CVE a 9.8 Critical score in its earlier MicroSCADA X SYS600 record. The scoring disagreement does not mean either source has found a sixth vulnerability; it reflects different assessments of how readily the condition can be reached and exploited in a particular product context.
For FCP operators, the prudent conclusion is not to average the scores. It is to verify whether the relevant GWS service is listening beyond localhost, document every interface and routing path that can reach it, and close unintended exposure. A service designed to remain local should never become reachable from a business network merely because an interface, firewall rule, remote-access tool, or routing change was introduced later.
CVE-2024-7941 is an open-redirect issue that can be used in credential-phishing attacks. It carries a lower 4.3 CVSS score, but low technical severity does not make it irrelevant in a control environment. An attacker who can redirect an operator or administrator through a plausible FCP-related web flow may obtain the credentials needed to exploit the higher-impact authenticated flaws.
These are established GWS issues, newly scoped to FACTS Control
The CVE numbering can mislead readers into assuming the bugs were discovered only this week. They were publicly recorded in 2024 in connection with Hitachi Energy’s MicroSCADA Pro/X SYS600 product, and Hitachi’s advisory catalogue also associates four of the five CVEs with a February 2025 MACH GWS advisory. Security reporting by Dark Reading and advisories from Spain’s INCIBE-CERT covered the earlier SYS600 disclosure and its upgrade path.
The more useful reading is that GWS is the common security boundary under renewed scrutiny. Hitachi’s July 2026 FCP notice extends the vendor’s affected-product mapping to FACTS control systems containing that component; it does not establish that FCP operators can use a SYS600 or MACH update package interchangeably.
That distinction is particularly important because the CISA republication provides only general defensive practices and directs customers to Hitachi Energy for product-specific support. It does not name a fixed FCP version, a hotfix build, a software download, or an upgrade sequence that resolves these flaws. An organization that sees FCP 4.1.1 in its inventory therefore cannot determine a remedy simply by looking for “4.1.2” in public release notes.
CISA also labels its September publication as a verbatim conversion of Hitachi’s CSAF advisory and says it is not responsible for its editorial or technical accuracy. In other words, CISA has increased visibility, but Hitachi remains the authoritative source for applicability and remediation.
What FCP and Windows administrators should do now
The immediate task is exposure reduction and evidence gathering, performed under the site’s normal change-control and operational-risk process. Industrial control systems cannot be handled like a routine desktop patch rollout; testing, vendor coordination, maintenance windows, and rollback planning may be required.
A focused response should include the following:
- Identify every FACTS Control Platform installation, its installed FCP version, commissioning and upgrade history, and whether GWS is installed or enabled.
- Confirm which hosts, ports, services, and network interfaces GWS uses, then determine whether any are accessible outside their intended local or control-network boundary.
- Remove direct Internet exposure and isolate FCP and associated engineering assets from corporate networks with tightly controlled firewalls. CISA specifically recommends minimizing network exposure, placing control systems behind firewalls, and separating them from business networks.
- Restrict remote access to approved, maintained VPN or jump-host paths, with multifactor authentication where the architecture supports it and logging retained outside the affected host.
- Review GWS user accounts, especially administrator, shared, vendor-support, and inactive accounts. Reset credentials where compromise is suspected and revoke access that is no longer required.
- Contact Hitachi Energy or the responsible product provider for the remediation package, supported upgrade path, compensating controls, and confirmation of whether the installation’s exact GWS configuration is exposed.
Neither Hitachi nor CISA reports known exploitation in the material published with this advisory. That is useful, but it is not an assurance that exposed systems can wait for a normal maintenance cycle. The combination of remote-facing service exposure, authenticated data and file manipulation, and a credential-phishing route creates a chain that defenders should break at multiple points.
For Windows-focused IT teams that support OT rather than own it, the immediate contribution is straightforward: find the Windows hosts that administer, host, back up, or remotely access FCP; validate segmentation; and make sure enterprise identity, VPN, remote-support, and endpoint-management changes have not opened a route into GWS. The concrete next step is a vendor-backed remediation plan for every confirmed GWS-equipped FCP installation, because the public advisory identifies the affected versions but leaves the actual fixed release and installation procedure unstated.