CVE-2026-9853

MicroSCADA X SYS600, Hitachi Energy's SCADA/energy-management platform, fails to enforce its own application-level authentication: any user holding a valid account on the hosting server's operating system can read and modify SYS600 application objects without authenticating to SYS600 itself (CWE-303). The CVSS 4.0 vector (AV:L/PR:L/UI:N) indicates exploitation requires only low-privilege local access to the hosting server and no user interaction. An attacker — typically an insider, a compromised local account, or another process on the host — can therefore view and alter application objects, with high confidentiality, integrity, and availability impacts producing a score of 8.5 (High). Customers running MicroSCADA X SYS600 are affected, especially control-room servers where non-SYS600 personnel have OS logon rights; no affected or fixed version ranges were specified in the source data. No public proof-of-concept, KEV listing, or elevated EPSS (0.1%) is known, so exploitation has not been observed.

What to do: As an interim control, restrict operating-system logon rights on SYS600 host servers to authorized SYS600 users and service accounts, and audit existing local accounts on those servers. Consult the Hitachi Energy security advisory for CVE-2026-9853 to identify patched MicroSCADA X SYS600 releases and upgrade when available, since no fixed versions are listed in the source data.