CVE-2026-9853
Vulnerability record
- High 8.5
Description
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects.
Key facts
- Published
- 3 Sep 2026
- Last changed
- 3 Sep 2026
- Assigned by
- Hitachi Energy
- EPSS
- 0.144% likely to be exploited in the next 30 days, higher than 3.783% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 8.5CVSS 4.0, Highfrom the CNA (Hitachi Energy)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
CAPEC-115 Authentication Bypass (CNA impact statement)
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | MicroSCADA SYS600 |
|
Timeline
- 3 Sep 2026 Published