Multiple Vulnerabilities Discovered in Hitachi Energy MicroSCADA X SYS600 Including CSV Injection and Privilege Escalation
Hitachi Energy has acknowledged three security vulnerabilities in the MicroSCADA X SYS600 product line. CVE-2026-9852 is a CSV injection flaw allowing malicious formula execution and potential code run on user machines. CVE-2026-9853 involves an incorrect implementation of an authentication algorithm that permits unauthenticated operating system users to read and modify SYS600 application objects. CVE-2026-9854 pertains to a RBAC mechanism flaw enabling privilege escalation for users of engineering tools. All three vulnerabilities affect MicroSCADA X SYS600 versions 10.7 and prior, with version 10.8 also listed as affected. Mitigation guidance includes updating to the latest patched version and applying recommended configuration strategies.