What was disclosed
Hitachi Energy says multiple vulnerabilities affect the SYS600 versions listed in its advisory. CISA's page says it is a verbatim republication of Hitachi Energy PSIRT 8DBD000249. The vendor first published it on September 1, 2026. On September 29 it added the researchers' names. CISA's own republication is the October 20 entry in the revision history.
CISA adds that it is not responsible for the technical accuracy of republished advisories. For decisions about your own systems, the vendor advisory and its referenced manuals are the authoritative sources.
The advisory credits Zachary Andrew Wagner, Steven Nicolais and Timotius Oetnung of Sandia National Laboratories' CyTRICS program with reporting the flaws to CISA. The advisory describes the sector as energy, with worldwide deployment. Nothing in the advisory text reports exploitation in the wild. Third-party aggregators that track these CVEs (OpenCVE and Strix) list KEV: No, meaning the CVEs are not in CISA's Known Exploited Vulnerabilities catalog. Strix puts the 30-day exploitation probability at 0.12%. Treat those figures as context, not guarantees.
The three CVEs
| CVE | Issue | CVSS 3.1 | CVSS 4.0 | CWE |
|---|---|---|---|---|
| CVE-2026-9852 | CSV formula injection via exported logs | 5.0 Medium | 4.6 Medium | CWE-1236 |
| CVE-2026-9853 | OS-authenticated user can read and modify application objects without SYS600 authentication | 7.8 High | 8.5 High | CWE-303 |
| CVE-2026-9854 | RBAC flaw lets engineering-tool users become administrator on the Windows host | 7.8 High | 8.5 High | CWE-303 |
CVE-2026-9852: CSV injection in exported logs
Malicious formulas can end up in SYS600 log data and then in an exported CSV file. When someone opens that file in a spreadsheet, the formulas can add or change data, insert links, and exfiltrate data. Depending on how the user's environment is configured, they can also run malicious code on that user's machine.
The attacker first needs a way to create arbitrary log messages. The advisory lists three routes: normal functionality through SCIL scripts, a separate log-injection bug, or the SYS600 broker. The exposed population is Windows users of any privilege level who can run the Notify service and export the log. The CVSS 3.1 vector includes user interaction (UI:R), because someone has to open the file.
This is a familiar Windows hazard. An operator exports logs for an audit or incident review and double-clicks the CSV on a workstation that may be connected to other networks. The advisory does not prescribe a spreadsheet setting or a sanitization routine. Don't assume one exists.
CVE-2026-9853: bypassing SYS600's own authentication
Any user authenticated to the operating system of the server hosting SYS600 can read and modify application objects without authenticating to SYS600 itself. The advisory states that only SYS600 system users should be able to view and modify those objects.
The score of 7.8 comes from a local attack vector with low privileges required and high impact on confidentiality, integrity and availability. In practice, every account that can log on to the host, including RDP users, service accounts and leftover admin accounts, becomes part of the SYS600 trust boundary.
CVE-2026-9854: engineering tools to Windows administrator
A flaw in the SYS600 RBAC mechanism lets users with access to the engineering tools raise their privileges to administrator on the underlying Windows host. That gives them full control of the machine. OpenCVE lists the impact as local privilege escalation. The advisory labels the weakness CWE-303 for this CVE as well, and I've kept that attribution.
Which versions are affected
This is the part most likely to be misread.
- Versions 10.7 and earlier are affected by all three CVEs. The vendor fix is to update to 10.8.
- Version 10.8 is also listed as known affected for CVE-2026-9853 and CVE-2026-9854. For those two entries the advisory gives mitigation, not a later fixed release.
- For CVE-2026-9853, the advisory says the mitigation strategy is available for versions 10.3 onwards. It points to section 2.1.7.5 of the MicroSCADA X SYS600 10.8 Installation and Administration Manual and to the MicroSCADA X 10.8 Cybersecurity Deployment Guide. The advisory does not reproduce the steps, so I won't guess at them.
So "upgrade to 10.8" is only part of the answer. It fixes the CSV issue for older installs. It doesn't, on the advisory's own terms, close the other two. Ask Hitachi Energy for the current remediation status before you call a 10.8 system clean.
What administrators should do
- Inventory. Find every SYS600 install, record its version, and note who can log on to each host.
- Upgrade and mitigate. Move 10.7-and-earlier systems to 10.8 where your change process allows. For CVE-2026-9853, read the manual section and deployment guide named above, and confirm they apply to your version.
- Shrink the local trust boundary. Because two of the three flaws are local, review which OS accounts can log on to the SYS600 server and who has engineering-tool access. This is my inference from the attack paths, not a vendor step.
- Handle exported logs carefully. Limit who can create log messages and export logs. Don't open exported CSVs casually on workstations that matter.
- Apply the general ICS hardening. Hitachi Energy's guidance is to physically protect process control systems and keep them off direct Internet connections. It also calls for firewall separation with a minimal set of exposed ports. Process control systems shouldn't be used for web browsing, instant messaging or email. Portable computers and removable media should be scanned before they connect, and password policies should be followed.
- Follow CISA's guidance. Minimize network exposure and keep control networks behind firewalls, isolated from business networks. Where remote access is required, use updated VPNs. CISA notes that a VPN is only as secure as the devices connected through it. Do an impact analysis before deploying defensive changes, and report suspected malicious activity to CISA.
Why Windows admins should care
None of these bugs is described as remotely exploitable. Two are rated 7.8 on a local, low-privilege vector. But SCADA servers tend to be shared by operators, engineers and contractors. In that setting, local privilege escalation to Windows administrator is a serious problem. The host's operating-system accounts and the SYS600 application's own permissions can't be treated as separate layers.
On the other side, the advisory describes no exploitation, and the required access (OS logon, engineering-tool rights, or the ability to inject log content) is real friction. A well-segmented environment lowers the risk considerably. Even so, local-access bugs on OT servers are the kind that matter once an attacker is already inside the network.