Quick answers
- Is CVE-2026-9852 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9852 being exploited in the wild.
- How severe is CVE-2026-9852?
- High severity, with a CVSS score of 7.8, published 3 September 2026.
- Which products and versions are affected?
- Hitachi Energy SYS600 all.
- Is there a fix for CVE-2026-9852?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9852 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-9852?
- Check whether you run Hitachi Energy SYS600 or Hitachienergy Microscada X Sys600 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a CSV injection (formula injection) vulnerability in SYS600's logging functionality. When log data is exported to CSV format, malicious formulas injected into log messages are not sanitized, allowing them to execute when opened in spreadsheet applications like Microsoft Excel. The vulnerability affects Windows users who can run the Notify service and export logs. Attackers must first establish a means to create arbitrary log entries via SCIL scripts, log injection, or the SYS600 broker. Once exported and opened in a spreadsheet application, the injected formulas can modify data, insert hyperlinks for credential theft, exfiltrate data, or achieve remote code execution depending on the victim's spreadsheet application configuration. A patch or mitigation should sanitize log entries before CSV export and disable formula evaluation in exported files.
Affected products
- Hitachi Energy SYS600 all
Identifiers
- CVE-2026-9852
- CVE-2026-9853
- CVE-2026-9854
Timeline
- 2026-09-03: disclosed