CVE-2026-9854 Privilege escalation in MicroSCADA SYS600

High 8.5 Published 3 Sep 2026 Updated 3 Sep 2026

Users with engineering tool access can escalate privileges to administrator on the Windows host, gaining full control over the machine.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-9854?

CVE-2026-9854 is a high-severity vulnerability in Hitachi Energy MicroSCADA SYS600, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.

Weakness: CWE-303

Which versions are affected by CVE-2026-9854?

It affects 1 product.

Products include Hitachienergy Microscada X Sys600.

How do I fix CVE-2026-9854?

No fix has been published for CVE-2026-9854 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-9854 being exploited?

There is no known exploitation of CVE-2026-9854 in the wild and no public exploit code.

Sources

Also known as GHSA-3968-4qvg-96wm.