# CVE-2026-9853: Hitachi Energy SYS600 unauthorized access to application objects

Source: https://junglewise.ai/threats/cve-2026-9853-hitachi-energy-sys600-unauthorized-access-to-application-objects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9853 · Severity: high · CVSS 7.8 · Published 2026-09-03

SYS600 is a power system management application used by utilities to control and monitor electrical infrastructure. A vulnerability allows any user with operating system access to the server to view and modify critical application data without needing legitimate SYS600 credentials, potentially enabling unauthorized changes to power system configurations or data theft.

Technologies: [Hitachi Energy SYS600](https://junglewise.ai/threats/technologies/sys600), [Hitachienergy Microscada X Sys600](https://junglewise.ai/threats/technologies/microscada-x-sys600). Vendors: [Hitachi Energy](https://junglewise.ai/threats/vendors/hitachi-energy), [Hitachienergy](https://junglewise.ai/threats/vendors/hitachienergy).

## Quick answers

**Is CVE-2026-9853 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9853 being exploited in the wild.

**How severe is CVE-2026-9853?** High severity, with a CVSS score of 7.8, published 3 September 2026.

**Which products and versions are affected?** Hitachi Energy SYS600.

**Is there a fix for CVE-2026-9853?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9853 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-9853?** Check whether you run Hitachi Energy SYS600 or Hitachienergy Microscada X Sys600. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass flaw in SYS600 that permits OS-level access to the server to escalate into application-level access. An attacker with local system access (such as through compromised credentials or direct server access) can read and modify application objects that should only be accessible to authenticated SYS600 users. The attack requires local/physical access to the server or prior compromise of OS-level credentials. No authentication to the SYS600 system itself is required once OS-level access is obtained. A patch is available as indicated by the published advisory.

## Affected products

- Hitachi Energy SYS600

## Timeline

- 2026-09-03: disclosed

## References

- [https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch](https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch)

## Related threats

- [Hitachi Energy SYS600 privilege escalation in RBAC mechanism](https://junglewise.ai/threats/cve-2026-9854-hitachi-energy-sys600-privilege-escalation-in-rbac-mechanism)
- [Hitachi Energy SYS600 CSV injection in logs](https://junglewise.ai/threats/cve-2026-9852-hitachi-energy-sys600-csv-injection-in-logs)