CVE-2026-9854
Vulnerability record
- High 8.5
Description
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
Key facts
- Published
- 3 Sep 2026
- Last changed
- 3 Sep 2026
- Assigned by
- Hitachi Energy
- EPSS
- 0.144% likely to be exploited in the next 30 days, higher than 3.784% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: total
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 8.5CVSS 4.0, Highfrom the CNA (Hitachi Energy)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
CAPEC-115 Authentication Bypass (CNA impact statement)
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Hitachi Energy | MicroSCADA SYS600 |
|
Timeline
- 3 Sep 2026 Published