Vulnerability · Published Sep 3, 2026 · Assigned by Hitachi Energy
CVE-2026-9852
Medium 4.6
In plain English
A medium-severity security flaw in MicroSCADA SYS600 from Hitachi Energy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | MicroSCADA SYS600 | 10.0 – through 10.7 |
Weakness: CWE-1236 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N