CVE-2026-9853 is a high severity (CVSS 7.8) missing authentication flaw in Hitachi Energy SYS600. Any user logged in to the operating system of the host can read and change application objects without authenticating to SYS600. Check Hitachi Energy advisory 8DBD000249 for the fixed version.
What's affected
The record lists Hitachi Energy MicroSCADA X SYS600. It gives no version range, no fixed version and no mitigations. The only reference is Hitachi Energy advisory 8DBD000249, which is a JavaScript application that did not return readable text when we fetched it, so we cannot say which SYS600 versions are affected or which release fixes it.
Please read the advisory directly, or ask your Hitachi Energy contact, before planning the upgrade. Three CVEs share this advisory in the same batch: CVE-2026-9852, CVE-2026-9853 and CVE-2026-9854, all scored 7.8, high.
The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attacker is local with low privileges: an account on the host operating system is enough. KEV is false.
How to check if you're exposed
Find your SYS600 installations and their exact version, which is normally shown in the product's system information. Then open the Hitachi Energy advisory and match your version against the affected and fixed lists.
Also record who has an operating system account on the SYS600 server. All three flaws in this advisory depend on a person or process that is already on the host or has engineering tool access, so the list of accounts is part of your exposure.
For this flaw, the key question is who holds a login on the SYS600 host. Include service accounts, remote desktop users, vendor support accounts and anyone with shared engineering credentials.
What to do now
- Read advisory 8DBD000249 and apply the fixed version or listed mitigations.
- Reduce the number of operating system accounts on SYS600 servers to those with a clear need. Remove shared and stale accounts.
- Restrict remote desktop and remote shell access to the host through a jump server with multi factor authentication.
- Log and review logins to the host, since a local account is the entry point for this flaw.
- Keep the SYS600 server out of general purpose use. No email, no browsing, no extra software.
Why it matters
The weakness type is CWE-303, and the record describes it as access to application objects without authenticating to SYS600. The record's statement is clear: only SYS600 system users should be allowed to view and modify application objects, and today any operating system user can.
That turns host access into application control. In an operational technology setting the application objects may represent process data and configuration, so an extra local account becomes a way to change what operators see.
The defensive point is to treat a SYS600 host as a single purpose, tightly controlled system. Reduce who can log in, log those who do, and apply the vendor fix.
Industrial control environments rarely appear in package based scanners, so this comes down to asset inventory and vendor advisories. Safeguard reachability analysis and the Gold directory help for the software components in your own applications, but for a vendor product like this one the advisory is the authority.
Quick check
Can a remote attacker use this directly?
The vector is local. An attacker needs an account on the host operating system, which could come from another compromise or from an insider.
What is the fix?
The record lists none. Hitachi Energy advisory 8DBD000249 is the place to look, and we could not read it.
Sources
Hitachi Energy advisory 8DBD000249, the page needs JavaScript and did not render for us, so versions and workarounds were not read Gold entry for CVE-2026-9853
Last reviewed: 18 October 2026.
