CVE-2026-9852 Code injection in MicroSCADA SYS600

Medium 4.6 Published 3 Sep 2026 Updated 3 Sep 2026

Attackers can inject malicious formulas into CSV exports to modify data or execute code on user machines via log injection in MicroSCADA SYS600.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-9852?

CVE-2026-9852 is a medium-severity code injection vulnerability in Hitachi Energy MicroSCADA SYS600, published on 3 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

Weakness: CWE-1236

Which versions are affected by CVE-2026-9852?

It affects 1 product.

Products include Hitachienergy Microscada X Sys600.

How do I fix CVE-2026-9852?

No fix has been published for CVE-2026-9852 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-9852 being exploited?

There is no known exploitation of CVE-2026-9852 in the wild and no public exploit code.

Sources

Also known as GHSA-5ph9-h7vg-rh4m.