Overview
CISA republished advisory ICSA-26-293-04 on 20 October 2026 (Revision 3). It covers Hitachi Energy’s MicroSCADA X SYS600, a SCADA and substation automation platform used in the energy sector. According to CISA’s advisory, the text is a verbatim republication of the vendor’s CSAF advisory, Hitachi Energy PSIRT 8DBD000249, first released 1 September 2026. Revision 2 (29 September) added the researcher acknowledgment.
CISA credits Zachary Andrew Wagner, Steven Nicolais and Timotius Oetnung of Sandia National Laboratories (CyTRICS program). The advisory does not report known exploitation, and its SSVC vector indicates exploitation “None” and automatable “No”.
This is based on a single source, the CISA page. We did not open the Hitachi Energy PSIRT original.
The three vulnerabilities
| CVE | CWE | CVSS v3.1 | CVSS v4.0 | Summary |
|---|---|---|---|---|
| CVE-2026-9852 | CWE-1236 | 5.0 | 4.6 | CSV formula injection in exported logs |
| CVE-2026-9853 | CWE-303 | 7.8 | 8.5 | OS-level users reach SYS600 application objects without SYS600 authentication |
| CVE-2026-9854 | CWE-303 | 7.8 | 8.5 | RBAC flaw lets engineering-tool users escalate to Windows administrator |
All three are local (AV:L in the published vectors). None is a remote, unauthenticated bug, which matters when prioritising.
CVE-2026-9853: application objects without SYS600 login
Per the advisory, any user authenticated to the host operating system can read and modify SYS600 application objects without authenticating to SYS600 itself. The vector scores confidentiality, integrity and availability all High. SYS600 application objects are the configuration and process data the platform uses to supervise substation equipment. Our assessment: on a shared Windows server, this removes SYS600’s own login as a security boundary. Anyone who can log on to the host, including a contractor account or a compromised low-privilege service account, is effectively inside the SCADA application.
CVE-2026-9854: RBAC escalation to Windows administrator
Users with access to engineering tools can elevate to Windows administrator and gain full control of the host. Pair this with the previous flaw and the local account becomes a path to the whole server. The advisory’s 10.8 entry for this CVE lists no specific remediation beyond updating and general mitigation factors.
CVE-2026-9852: CSV injection
Formulas embedded in exported logs can modify spreadsheet data, insert links, exfiltrate data, and in some configurations execute code on the analyst’s machine. The attacker needs to be able to create arbitrary log messages, which the advisory says could happen through SCIL scripts, a log injection flaw or the SYS600 broker. It affects Windows users who can run the Notify service and export the log. It needs user interaction (UI:R), so the realistic target is the engineer or operator who opens an exported log in a spreadsheet.
Affected versions and fix
Affected: SYS600 10.7 and prior, and 10.8 as listed in the advisory. The advisory’s fixed-version wording is that 10.8 is the vendor remediation for most CVEs. Because 10.8 appears in the affected range as well, we cannot tell from the CISA page alone which build contains each fix. Confirm the exact fixed build with Hitachi Energy before planning the upgrade.
For CVE-2026-9853, the advisory points to Section 2.1.7.5 of the SYS600 10.8 Installation and Administration Manual (available from 10.3 onward) and the MicroSCADA X 10.8 Cybersecurity Deployment Guide. We have not read either document.
Operational impact
SYS600 typically runs on Windows servers inside substation or control-centre networks. Local flaws are often discounted because “an attacker would need to be on the box”. In OT that bar is lower than it sounds: shared engineering workstations, vendor support accounts and remote-access jump hosts all provide OS-level logins. After an initial foothold elsewhere, these flaws are the kind that turn a limited account into control of the supervisory host. Our assessment, not a vendor statement.
What asset owners can do
- Inventory SYS600 hosts and versions; plan the move to the fixed release after testing, since the advisory advises impact analysis before changes.
- Review who holds OS logins and engineering-tool access on SYS600 servers, and remove shared or stale accounts.
- Treat exported logs as untrusted. Open them in a viewer rather than a spreadsheet, or ensure formula evaluation is disabled.
- Alert on new local administrator group members and on engineering tool launches by unexpected accounts on these hosts. This is a general detection idea of ours, not from the advisory, and needs tuning to your environment.
- Keep the hosts off the internet and behind firewalls, and use updated VPNs for remote access, as CISA recommends.
Sources
- CISA ICSA-26-293-04 (opened)
- CISA bulletin listing the 20 October advisories (opened)