CVE-2026-9854

CVE-2026-9854 is a privilege escalation flaw in the role-based access control (RBAC) mechanism of Hitachi Energy MicroSCADA X SYS600 (CWE-303). A user who is authorized to use the SCADA system's engineering tools can leverage that access to elevate their privileges to administrator level on the underlying Windows host. Successful exploitation grants the attacker full control over the host machine, beyond the SCADA application itself. Any organization running MicroSCADA X SYS600 on Windows where users have access to the engineering tools is affected. There is no known exploitation in the wild, no public proof-of-concept, and a low predicted exploitation probability (EPSS 0.1%, not in CISA KEV).

What to do: Check the Hitachi Energy security advisory (published by their CNA) for fixed MicroSCADA X SYS600 versions and apply the vendor patch as soon as it is available, since no specific version numbers are given here. In the meantime, restrict access to the engineering tools to trusted personnel, apply least-privilege on the underlying Windows hosts, and monitor for unexpected local administrator account or privilege changes. Utilities should inventory which SYS600 Windows hosts allow engineering-tool access, as only those are exposed to this local escalation path.