Vulnerability Description
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hitachienergy | Microscada X Sys600 | >= 10.0, <= 10.7 |
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-9852?
CVE-2026-9852 is a vulnerability with a CVSS score of 7.8 (HIGH). A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has t...
How severe is CVE-2026-9852?
CVE-2026-9852 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9852?
Check the references section above for vendor advisories and patch information. Affected products include: Hitachienergy Microscada X Sys600.