Hitachi Energy MicroSCADA X SYS600 Product: 3 CVEs, High 7.8
Summary
CISA reports 3 vulnerabilities in Hitachi Energy MicroSCADA X SYS600. Weakness types: Improper Neutralization of Formula Elements in a CSV File, Incorrect Implementation of Authentication Algorithm. Hitachi Energy is aware of multiple vulnerabilities that affect MicroSCADA X SYS600 product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks on the product. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Hitachi Energy
- Products
- MicroSCADA X SYS600
- CVEs
- CVE-2026-9852, CVE-2026-9853, CVE-2026-9854
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Switzerland
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-9852 | Improper Neutralization of Formula Elements in a CSV File | 5 | – | No | CVE-2026-9852 |
| CVE-2026-9853 | Incorrect Implementation of Authentication Algorithm | 7.8 | – | No | CVE-2026-9853 |
| CVE-2026-9854 | Incorrect Implementation of Authentication Algorithm | 7.8 | – | No | CVE-2026-9854 |
Affected products (2)
- MicroSCADA X SYS600 versions 10.7 and prior
- MicroSCADA X SYS600 version 10.8
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Update to version 10.8
- Mitigation: Follow general mitigation factors/workarounds
- Vendor Fix: Update to version 10.8 and Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide
- Mitigation: Follow mitigation strategy. Refer to MicroSCADA X SYS00 10.8 Installation and Administration Manual, Section 2.1.7.5 (Mitigation strategy is available for versions 10.3 onwards). Also refer to MicroSCADA X 10.8 Cybersecurity Deployment Guide
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-293-04
- Machine-readable CSAF record
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000235&LanguageCode=en&Document
- https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&Document
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.