CVE-2026-9853CWE-303

CVE-2026-9853

High · published September 3, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself.

Only the SYS600 system users should be permitted to view and modify application objects.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-09-03T17:06Z
Affected products (1)
ProductVersionsFixed in
hitachienergy/microscada_x_sys600≥ 10.0, ≤ 10.8—
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 04 SEP 03:45Z
    EPSS moved — → 0%
    epss
  • 03 SEP 07:53Z
    A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify…
    cvelistv5