CVE-2026-9852 is a high severity (CVSS 7.8) CSV injection flaw in Hitachi Energy SYS600, in the log export used with the Notify service. Injected spreadsheet formulas can change data, add links or leak data. Check Hitachi Energy advisory 8DBD000249 for the fixed version and treat exported logs as untrusted.
What's affected
The record lists Hitachi Energy MicroSCADA X SYS600. It gives no version range, no fixed version and no mitigations. The only reference is Hitachi Energy advisory 8DBD000249, which is a JavaScript application that did not return readable text when we fetched it, so we cannot say which SYS600 versions are affected or which release fixes it.
Please read the advisory directly, or ask your Hitachi Energy contact, before planning the upgrade. Three CVEs share this advisory in the same batch: CVE-2026-9852, CVE-2026-9853 and CVE-2026-9854, all scored 7.8, high.
The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The record says the issue affects all Windows users, whatever their privilege level, who can run the Notify service and export the log. KEV is false.
How to check if you're exposed
Find your SYS600 installations and their exact version, which is normally shown in the product's system information. Then open the Hitachi Energy advisory and match your version against the affected and fixed lists.
Also record who has an operating system account on the SYS600 server. All three flaws in this advisory depend on a person or process that is already on the host or has engineering tool access, so the list of accounts is part of your exposure.
For this flaw specifically, find out who exports SYS600 logs to spreadsheets and what opens them. If operators routinely open the exported file in a spreadsheet program, that is the exposure point.
What to do now
- Read advisory 8DBD000249 and apply the fixed version or the mitigations it lists.
- Until patched, do not open exported SYS600 log files in a spreadsheet program on machines that matter. Use a plain text viewer instead.
- Configure spreadsheet software to disable automatic formula evaluation and external links for files from untrusted sources.
- Limit who can create log messages or reach the SYS600 broker, since the record says an attacker needs a way to write arbitrary log messages.
- Train operators to treat any unexpected prompt from a spreadsheet as a sign to stop and report it.
Why it matters
The weakness type is CWE-1236, improper neutralisation of formula elements in a CSV file. When a program writes untrusted text into a CSV file without defusing leading characters, a spreadsheet may treat that text as a formula when someone opens it. The record says the possible results run from changing data, to inserting links, to exfiltrating data, to code execution depending on how the user's environment is set up.
The attacker first needs a way to put arbitrary log messages in. The record names three routes: normal functionality through SCIL scripts, a separate log injection flaw, or the SYS600 broker. That makes this a chained risk, so defenders should look at each entry point to the log.
Industrial control environments rarely appear in package based scanners, so this comes down to asset inventory and vendor advisories. Safeguard reachability analysis and the Gold directory help for the software components in your own applications, but for a vendor product like this one the advisory is the authority.
Quick check
Does this need a login?
The CVSS vector shows no privileges required and user interaction required, since someone must open the exported file. The record also says an attacker needs a way to create log messages.
Where do I find the fixed version?
In Hitachi Energy advisory 8DBD000249. We could not render it, so check it directly.
Sources
Hitachi Energy advisory 8DBD000249, the page needs JavaScript and did not render for us, so versions and workarounds were not read Gold entry for CVE-2026-9852
Last reviewed: 18 October 2026.
