CVE-2026-9852
Vulnerability record
- Medium 4.6
Description
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
Key facts
- Published
- 3 Sep 2026
- Last changed
- 3 Sep 2026
- Assigned by
- Hitachi Energy
- EPSS
- 0.209% likely to be exploited in the next 30 days, higher than 11.116% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 4.6CVSS 4.0, Mediumfrom the CNA (Hitachi Energy)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
CAPEC-242 Code Injection (CNA impact statement)
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | MicroSCADA SYS600 |
|
Timeline
- 3 Sep 2026 Published