CVE-2026-9854CWE-303

CVE-2026-9854

High · published September 3, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-09-03T17:06Z
Affected products (1)
ProductVersionsFixed in
hitachienergy/microscada_x_sys600≥ 10.0, ≤ 10.7—
References (1)
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000249&LanguageCode=en&DocumentPartId=&Action=Launch · [email protected]
EPSS history
Timeline
  • 04 SEP 03:45Z
    EPSS moved — → 0%
    epss
  • 03 SEP 07:55Z
    A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the…
    cvelistv5