High Patch available CVSS up to 7.8
Hitachi Energy MicroSCADA X SYS600 has CSV injection and authentication flaws
CISA ICS AdvisoriesHitachi Energy, MicroSCADA X SYS600 · energyCVE-2026-9852, CVE-2026-9853, CVE-2026-9854
What happened. Hitachi Energy reported multiple vulnerabilities in MicroSCADA X SYS600, including CSV injection, where malicious formulas can alter spreadsheet data, exfiltrate data or run code, and an incorrect authentication algorithm. The vendor CVSS v3 score is 7.8.
Who is affected. Hitachi Energy MicroSCADA X SYS600 versions up to 10.7, and 10.8, in the energy sector.
What to do. Check whether you run MicroSCADA X SYS600 10.7 or earlier, or 10.8, and follow Hitachi Energy's Recommended Immediate Actions.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: MicroSCADA X SYS600 is SCADA software, which runs at the supervisory level (L2) and often on site operations servers (L3).
- Are you exposed?
Search your asset inventory for MicroSCADA X SYS600 and compare installed versions with 10.7 or earlier and 10.8.
- If you cannot fix it yet
- Open files exported from SYS600 only in viewers that do not evaluate formulas, or disable formula execution in the spreadsheet application.
- Restrict access to SYS600 to named operator hosts and accounts.
- Watch for
- Spreadsheet applications starting child processes after opening files exported from SYS600.
- Authentication events on SYS600 from unexpected hosts or accounts.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Hitachi Energy ABB Energy and power CVE-2026-9852 CVE-2026-9853 CVE-2026-9854