Hitachi Energy MicroSCADA X SYS600 multiple vulnerabilities (CVE-2026-9852, CVE-2026-9853, CVE-2026-9854)

Hitachi Energy has disclosed three vulnerabilities affecting the MicroSCADA X SYS600 product, impacting versions 10.7 and prior, with some components affecting version 10.8. The disclosed flaws include CVE-2026-9852 (CWE-1236), a CSV injection vulnerability that could lead to data exfiltration or malicious code execution if an attacker can inject formulas into system logs. CVE-2026-9853 (CWE-303) allows local OS-authenticated users to bypass SYS600 authentication and interact with application objects. CVE-2026-9854 (CWE-303) involves a weakness in the Role-Based Access Control (RBAC) mechanism where users of engineering tools can escalate their privileges to Windows host administrator level. These vulnerabilities were reported by Sandia National Laboratories and are critical for organizations in the energy sector to address due to the potential for unauthorized industrial control system manipulation.

Impact

Successful exploitation of these vulnerabilities could result in unauthorized modification of critical application objects, exfiltration of sensitive data, and full administrative compromise of the underlying Windows host machine. These flaws directly target the integrity and availability of industrial control environments, potentially causing operational disruption or safety risks.

Recommendation

• Upgrade MicroSCADA X SYS600 to version 10.8 immediately to address the identified vulnerabilities.
• Implement the mitigation strategies defined in the MicroSCADA X SYS600 10.8 Installation and Administration Manual (Section 2.1.7.5) and the 10.8 Cybersecurity Deployment Guide.
• Restrict access to the server operating system to only essential personnel to mitigate the risk associated with CVE-2026-9853 and CVE-2026-9854.
• Enforce strict monitoring of log files and export activities to detect potential CSV injection (CVE-2026-9852) attempts.