CISA advisory flags flaws in Hitachi Energy MicroSCADA X SYS600
The ICS advisory describes a CSV injection bug, an authentication weakness and a privilege escalation path in the SCADA product used in the energy sector, with version 10.8 named as the vendor fix.
CISA published an ICS advisory on October 20, 2026 covering multiple vulnerabilities in Hitachi Energy's MicroSCADA X SYS600, a product the advisory lists as deployed worldwide in the energy sector. Hitachi Energy is headquartered in Switzerland.
The advisory describes three issues. One is a CSV injection flaw: malicious formulas placed in exported log data could add or modify spreadsheet content, insert links or exfiltrate data, and in some configurations run code on the user's machine. Exploiting it requires a way to create arbitrary log messages, which the advisory says could come through normal SCIL script functionality, a log injection flaw or the SYS600 broker. It affects Windows users who can run the Notify service and export the log, regardless of privilege level.
A second flaw lets anyone authenticated to the host operating system read and modify application objects without authenticating to SYS600 itself. A third involves the role-based access control mechanism, where users with access to engineering tools could raise their privileges to administrator on the underlying Windows host.
The advisory lists versions 10.7 and prior as affected, and also marks 10.8 as affected for the authentication and RBAC issues. It names updating to version 10.8 as the vendor fix and points to a mitigation strategy documented for versions 10.3 onwards.
Defenders running SYS600 should treat host-level accounts as part of the SCADA trust boundary, restrict who can reach engineering tools, and check the vendor's installation and cybersecurity deployment guidance before planning upgrades.
CVE references
Sources
- Hitachi Energy MicroSCADA X SYS600 ProductPrimarywww.cisa.gov
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
