CVE-2026-9853 is an incorrect-authentication-implementation flaw in Hitachi Energy's MicroSCADA X SYS600 that lets any user already authenticated to the underlying Windows server — without any SYS600 credentials of their own — read and modify SYS600 application objects, effectively bypassing the SCADA system's own access control.
Vulnerability summary
CVSS base score
7.8
High severity
EPSS score (FIRST)
0.1%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-9853 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Hitachi Energy MicroSCADA X SYS600 | cpe:2.3:a:hitachienergy:microscada_x_sys600:*:*:*:*:*:*:*:* | through 10.7 (fixed in 10.8, per CISA ICS Advisory ICSA-26-293-04) |
What does this mean for affected devices?
CVE-2026-9853 is an incorrect implementation of an authentication algorithm (CWE-303) in Hitachi Energy MicroSCADA X SYS600. NVD's description states the flaw "allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself," meaning the SCADA-level login is not actually required once an attacker holds any local Windows account on the host (NVD).
NVD lists this CVE as fully analyzed (status "Analyzed") and has itself assigned a CVSS v3.1 base score of 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local access with only low privileges needed, no user interaction, and high impact to confidentiality, integrity and availability once an attacker can read and write SCADA objects; Hitachi Energy's own CVSS v4.0 submission scores it 8.5 (NVD).
CISA's advisory ICSA-26-293-04, published 2026-10-20 (initial release 2026-09-01), confirms MicroSCADA X SYS600 versions through 10.7 are affected and recommends updating to version 10.8, alongside two related CVEs disclosed in the same advisory: CVE-2026-9852 (CSV injection) and CVE-2026-9854 (an RBAC privilege-escalation flaw letting engineering-tool users reach administrator level) (CISA ICS Advisory ICSA-26-293-04).
CISA's advisory also notes the standard ICS mitigation posture — minimizing network exposure for control-system devices and keeping them off the public internet — applies here, since exploitation requires an attacker to first obtain any account on the Windows host running SYS600 (CISA ICS Advisory ICSA-26-293-04).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.0014 (3.4th percentile) — low, consistent with a flaw that needs pre-existing host access rather than being remotely, unauthenticated exploitable (CISA KEV, FIRST EPSS).
Because the vulnerability defeats SYS600's own access control for anyone who already has a Windows account on the host, operators should update to version 10.8, and in the meantime tightly restrict which accounts exist on SYS600 servers so that only SYS600 operators — not general IT or engineering staff — have any login there at all.
Evidence
- Any user authenticated to the host OS can read/modify SYS600 application objects without SYS600-level authentication (CWE-303). — NVD
- CVSS v3.1 base score 7.8 (NVD-assigned, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); Hitachi Energy's own CVSS v4.0 submission scores it 8.5. — NVD
- Affects MicroSCADA X SYS600 through version 10.7, fixed in 10.8; disclosed alongside related CVE-2026-9852 and CVE-2026-9854 in the same advisory. — CISA ICS Advisory ICSA-26-293-04
- Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
- EPSS score is 0.0014 (3.4th percentile) as of 2026-10-21. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Does an attacker need SYS600 credentials to exploit CVE-2026-9853?
No — NVD's description states the flaw "allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself," so only a local Windows account on the host is needed, not any SYS600-level login (per NVD).
Why is the CVSS score only 7.8 rather than higher given the impact?
NVD's own CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local access vector with only low privileges needed, reflecting that exploitation requires the attacker to already hold an account on the Windows host, not a purely remote unauthenticated path; Hitachi Energy's own CVSS v4.0 submission scores it higher, at 8.5 (per NVD).
Was CVE-2026-9853 disclosed alongside other MicroSCADA vulnerabilities?
Yes — CISA's advisory ICSA-26-293-04 discloses it alongside two related CVEs: CVE-2026-9852 (CSV injection) and CVE-2026-9854 (an RBAC privilege-escalation flaw letting engineering-tool users reach administrator level) (per CISA ICS Advisory ICSA-26-293-04).
Which MicroSCADA X SYS600 versions are affected and what fixes them?
Versions through 10.7 are affected; CISA's advisory recommends updating to version 10.8 (per CISA ICS Advisory ICSA-26-293-04).
Is CVE-2026-9853 known to be actively exploited?
No — it is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at only 0.0014 (3.4th percentile), consistent with a flaw that needs pre-existing host access rather than being remotely, unauthenticated exploitable (per CISA KEV; per FIRST EPSS).
Questions about this page?