CVE-2026-9852

What it is

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-03 13:06 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-09 19:31 UTC Last updatedMost recent change to the record

Details

Published

2026-09-03 13:06 UTC

Last modified

2026-09-09 19:31 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-1236

Record status

Analyzed

Affected

• Hitachienergy Microscada X sys600 ≤ 10.7

Attack profile CVSS 4.0 · 4.6

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

Low

Integrity

Low

Availability

None