CVE-2026-9854: hitachi energy microscada sys600
CVSS: 8.5v4.0HighAnalyzed
Published 03-09-2026Last modified 03-09-2026
Vulnerability summary
CVE-2026-9854 is a high (CVSS 8.5) vulnerability in hitachi energy microscada sys600. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.3% of scored vulnerabilities.
CVSS score
8.5/10
010
High · v4.0 (CVE.org)EPSS score
0.14%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-09-2026PublishedVulnerability first disclosed.
- 03-09-2026Last modifiedVulnerability information updated.
Description
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.5Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 2 agree
- NVDNIST8.5HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.02 pp
From 0.13% on 21-09-2026
21-09-202621-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hitachi energy1 product
- microscada sys600≥ 10.0, ≤ 10.7
Hitachienergy1 product
- microscada_x_sys600≥ 10.0, ≤ 10.7
2 vendors · 2 products
References
1 links- publisher.hitachienergy.com/previewVendor Advisory