Hitachi Energy MicroSCADA X SYS600 flaws allow local privilege abuse
Original title: Hitachi Energy MicroSCADA X SYS600 Product
Versions 10.7 and earlier need 10.8 for two flaws; 10.8 still needs a documented mitigation for the authentication issue.
CISA republished Hitachi Energy’s notice of vulnerabilities in MicroSCADA X SYS600, an energy-sector product deployed worldwide. CVE-2026-9852 is CSV formula injection that can alter spreadsheets or, depending on the user’s setup, run code. CVE-2026-9853 lets any OS-authenticated user read and modify SYS600 objects without SYS600 authentication. CVE-2026-9854 lets engineering-tool users become Windows administrators. Sandia National Laboratories reported the issues. Vendor CVSS v3 scores are 5.0, 7.8, and 7.8.
Unconfirmed: The advisory text repeats affected-product blocks and does not clearly state a fix for every 10.8 case of CVE-2026-9854.
- CVE-2026-9852 affects 10.7 and prior; the vendor fix is version 10.8.
- CVE-2026-9853 affects 10.7 and prior and version 10.8; 10.8 still needs the section 2.1.7.5 mitigation.
- CVE-2026-9854 is fixed in 10.8 for versions 10.7 and prior; some 10.8 status text is incomplete.
- CWE-1236 covers the CSV issue; CWE-303 covers the authentication flaws.
Impact: Local users can modify objects or gain Windows admin control
| Product | Affected | Fixed in |
|---|---|---|
| Hitachi Energy MicroSCADA X SYS600 | 10.7 and prior | 10.8 |
| Hitachi Energy MicroSCADA X SYS600 | 10.8 | — |
- 1.Update MicroSCADA X SYS600 10.7 and prior to version 10.8 where a vendor fix is listed.
- 2.Apply the mitigation in the 10.8 Installation and Administration Manual, section 2.1.7.5, including on 10.8 for CVE-2026-9853.
- 3.Follow the MicroSCADA X 10.8 Cybersecurity Deployment Guide.
- Vendors
- Hitachi Energy
- Products
- MicroSCADA X SYS600
- Organizations
- CISASandia National Laboratories
- Countries
- Switzerland
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-9853+2 related CVEs | Authentication Bypass in Hitachi Energy MicroSCADA X SYS600 | 8.5 group max | <1% |
From the original article
6 min read at cisa.govView CSAF Summary Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.