These vulnerabilities, discovered by Zachary Andrew Wagner, Steven Nicolais, and Timotius Oetnung of the Sandia National Laboratories (CyTRICS program), can end up exploited to carry out various attacks on the product.
Hitachi Energy MicroSCADA X SYS600 is a real-time Supervisory Control and Data Acquisition (SCADA) and substation automation system used for monitoring, controlling, and managing electrical power networks and industrial processes.
The following versions of Hitachi Energy MicroSCADA X SYS600 Product suffer from the vulnerabilities: Up to and including version 10.7.
CSV Injection
In one issue, a CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue, attackers would need a way to create arbitrary log messages. This could end up achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
CVE-2026-9852 is the case number for the vulnerability, which has as CVSS V3 base score of 5. There is also a V4 base score of 4.6.
Additionally, a vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should end up permitted to view and modify application objects.
CVE-2026-9853 is the case number for the vulnerability, which has as CVSS V3 base score of 7.8. There is also a V4 base score of 8.5.
Alsos, a vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
CVE-2026-9854 is the case number for the vulnerability, which has as CVSS V3 base score of 7.8. There is also a V4 base score of 8.5.
The product sees use mainly in the energy sector, and on a global basis.
Mitigations
In terms of mitigations, users should update to version 10.8 and follow general mitigation factors and workarounds.
For additional information and support contact your product provider or Hitachi Energy service organization.
Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network.
Such practices include process control systems end up physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and have separation from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case.
Additionally, process control systems should not end up used for Internet surfing, instant messaging, or receiving emails. Portable computers and removable storage media should end up carefully scanned for viruses before they connect to a control system. Furthermore, users should follow proper password policies and processes.
Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification.