Dirty Frag Flaws Grant Root on Hitachi Energy APM Edge
Two kernel memory-corruption bugs let any local user become root; the advisory tells operators to disable networking modules but doesn't say when a patch ships.
TL;DR
CISA published an advisory Thursday for CVE-2026-43284 (CVSS 8.8) and CVE-2026-43500 (CVSS 7.8), two "Dirty Frag" privilege-escalation vulnerabilities in Hitachi Energy APM Edge versions 6.10 and earlier. The flaws live in the Linux kernel's IPsec ESP and RxRPC subsystems, any local unprivileged user who can load the esp4, esp6, or rxrpc modules can craft packets that corrupt kernel memory and escalate to root. Energy infrastructure operators worldwide run APM Edge for asset performance monitoring. Hitachi Energy's only listed remediation is to disable the vulnerable kernel modules; no patch timeline or confirmation of an unaffected version accompanies the advisory.
The two vulnerabilities CISA republished Thursday share a common mechanism: the Linux kernel's handling of fragmented network packets creates write-what-where conditions in memory pages the kernel doesn't own. In CVE-2026-43284, the IPsec ESP subsystem (esp4 and esp6 kernel modules) decrypts incoming packets directly into cached copies of privileged binaries. In CVE-2026-43500, the RxRPC protocol implementation does the same via externally owned memory fragments. In both cases, the attacker's injected code runs the next time the corrupted binary executes, and it runs as root.
The attack vector is local, meaning the attacker needs a foothold on the APM Edge device first. But that foothold can be any unprivileged user account, and in OT environments the gap between "local user" and "root" is often the only thing preventing a compromised monitoring station from becoming a compromised control plane. CVSS 8.8 on the ESP vulnerability reflects the scope change: a local compromise that hands over the whole system.
What the advisory doesn't say is when Hitachi Energy will ship a fix. The only remediation listed is to disable the esp4, esp6, and rxrpc kernel modules. For production APM Edge deployments that use IPsec for secure telemetry or RxRPC for inter-node communication, disabling those modules isn't a workaround, it's a feature amputation. The advisory offers no guidance on what breaks when you pull them, and no confirmation that an unaffected version exists or is imminent.
This is the third privilege-escalation advisory for APM Edge in CISA's catalog. In 2022, CVE-2021-4034 and CVE-2022-0492 let local users escalate to root on versions 1.0 through 4.0. The 2023 advisory added remote-exploitable use-after-free and double-free vulnerabilities in the same product line. Each time, the remediation was "upgrade to the latest version." This time, there's no version to upgrade to.
For the engineer managing APM Edge at an energy facility, the decision lands on a Friday. Disable the modules and risk breaking telemetry, or leave them loaded and accept that any local account (including a compromised contractor laptop plugged into the same segment) is one crafted packet away from root. The advisory's SSVC decision tree marks exploitation as "none," but the publication clock started July 24; the gap between "none observed" and "none attempted" is as wide as the gap between local and root.
Published ·Deep Fathom