Source: cisa.gov
CISA republished a Hitachi Energy advisory disclosing multiple vulnerabilities affecting MicroSCADA X SYS600 versions 10.7 and prior, as well as version 10.8. CVE-2026-9852 is a CSV injection vulnerability (CVSS 3.1: 5.0, MEDIUM) allowing formula injection, data exfiltration, and potential code execution via malicious log messages. CVE-2026-9853 is an incorrect authentication algorithm implementation (CVSS 3.1: 7.8, HIGH) allowing OS-authenticated users to read and modify SYS600 application objects without SYS600 credentials. CVE-2026-9854 is a privilege escalation vulnerability (CVSS 3.1: 7.8, HIGH) in the RBAC mechanism enabling engineering tool users to elevate privileges to Windows administrator level. Affected products are deployed worldwide in the Energy critical infrastructure sector. Remediation includes updating to version 10.8 and following mitigation strategies outlined in the MicroSCADA X SYS600 10.8 Installation and Administration Manual. Vulnerabilities were reported by researchers from Sandia National Laboratories via the CyTRICS program.
