CVE-2026-9853: Hitachi Energy MicroSCADA Auth Bypass

CVE-2026-9853 is an incorrect-authentication-implementation flaw in Hitachi Energy's MicroSCADA X SYS600 that lets any user already authenticated to the underlying Windows server — without any SYS600 credentials of their own — read and modify SYS600 application objects, effectively bypassing the SCADA system's own access control.

CVE-2026-9853 is an incorrect implementation of an authentication algorithm (CWE-303) in Hitachi Energy MicroSCADA X SYS600. NVD's description states the flaw "allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself," meaning the SCADA-level login is not actually required once an attacker holds any local Windows account on the host (NVD).

NVD lists this CVE as fully analyzed (status "Analyzed") and has itself assigned a CVSS v3.1 base score of 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local access with only low privileges needed, no user interaction, and high impact to confidentiality, integrity and availability once an attacker can read and write SCADA objects; Hitachi Energy's own CVSS v4.0 submission scores it 8.5 (NVD).

CISA's advisory ICSA-26-293-04, published 2026-10-20 (initial release 2026-09-01), confirms MicroSCADA X SYS600 versions through 10.7 are affected and recommends updating to version 10.8, alongside two related CVEs disclosed in the same advisory: CVE-2026-9852 (CSV injection) and CVE-2026-9854 (an RBAC privilege-escalation flaw letting engineering-tool users reach administrator level) (CISA ICS Advisory ICSA-26-293-04).

CISA's advisory also notes the standard ICS mitigation posture — minimizing network exposure for control-system devices and keeping them off the public internet — applies here, since exploitation requires an attacker to first obtain any account on the Windows host running SYS600 (CISA ICS Advisory ICSA-26-293-04).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.0014 (3.4th percentile) — low, consistent with a flaw that needs pre-existing host access rather than being remotely, unauthenticated exploitable (CISA KEV, FIRST EPSS).

Because the vulnerability defeats SYS600's own access control for anyone who already has a Windows account on the host, operators should update to version 10.8, and in the meantime tightly restrict which accounts exist on SYS600 servers so that only SYS600 operators — not general IT or engineering staff — have any login there at all.

• Any user authenticated to the host OS can read/modify SYS600 application objects without SYS600-level authentication (CWE-303). — NVD
• CVSS v3.1 base score 7.8 (NVD-assigned, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Hitachi Energy's own CVSS v4.0 submission scores it 8.5. — NVD
• Affects MicroSCADA X SYS600 through version 10.7, fixed in 10.8; disclosed alongside related CVE-2026-9852 and CVE-2026-9854 in the same advisory. — CISA ICS Advisory ICSA-26-293-04
• Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
• EPSS score is 0.0014 (3.4th percentile) as of 2026-10-21. — FIRST EPSS