{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/microscada-x-sys600--10.7-10.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hitachienergy:microscada_x_sys600:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-9852"},{"cvss":7.8,"id":"CVE-2026-9853"},{"id":"CVE-2026-9854"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MicroSCADA X SYS600 (\u003c= 10.7, 10.8)"],"_cs_severities":["high"],"_cs_tags":["ics","vulnerability","energy"],"_cs_type":"advisory","_cs_vendors":["Hitachi Energy"],"content_html":"\u003cp\u003eHitachi Energy has disclosed three vulnerabilities affecting the MicroSCADA X SYS600 product, impacting versions 10.7 and prior, with some components affecting version 10.8. The disclosed flaws include CVE-2026-9852 (CWE-1236), a CSV injection vulnerability that could lead to data exfiltration or malicious code execution if an attacker can inject formulas into system logs. CVE-2026-9853 (CWE-303) allows local OS-authenticated users to bypass SYS600 authentication and interact with application objects. CVE-2026-9854 (CWE-303) involves a weakness in the Role-Based Access Control (RBAC) mechanism where users of engineering tools can escalate their privileges to Windows host administrator level. These vulnerabilities were reported by Sandia National Laboratories and are critical for organizations in the energy sector to address due to the potential for unauthorized industrial control system manipulation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities could result in unauthorized modification of critical application objects, exfiltration of sensitive data, and full administrative compromise of the underlying Windows host machine. These flaws directly target the integrity and availability of industrial control environments, potentially causing operational disruption or safety risks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MicroSCADA X SYS600 to version 10.8 immediately to address the identified vulnerabilities.\u003c/li\u003e\n\u003cli\u003eImplement the mitigation strategies defined in the MicroSCADA X SYS600 10.8 Installation and Administration Manual (Section 2.1.7.5) and the 10.8 Cybersecurity Deployment Guide.\u003c/li\u003e\n\u003cli\u003eRestrict access to the server operating system to only essential personnel to mitigate the risk associated with CVE-2026-9853 and CVE-2026-9854.\u003c/li\u003e\n\u003cli\u003eEnforce strict monitoring of log files and export activities to detect potential CSV injection (CVE-2026-9852) attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T17:31:42Z","date_published":"2026-10-20T17:31:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hitachi-microscada-vulnerabilities/","summary":"Hitachi Energy MicroSCADA X SYS600 is affected by multiple vulnerabilities, including CSV injection, authentication bypass, and privilege escalation, which could allow attackers to gain unauthorized access or control over host systems.","title":"Hitachi Energy MicroSCADA X SYS600 multiple vulnerabilities (CVE-2026-9852, CVE-2026-9853, CVE-2026-9854)","url":"https://feed.craftedsignal.io/briefs/2026-10-hitachi-microscada-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - MicroSCADA X SYS600 (\u003c= 10.7, 10.8)","version":"https://jsonfeed.org/version/1.1"}