CVE-2026-9854
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.12%
- CWE
- CWE-303
- Published
- 2026-09-03
- Last modified
- 2026-09-03
Affected products
- Hitachi Energy MicroSCADA SYS600
Weakness type
Related vulnerabilities
- CVE-2026-78629 — Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling
- CVE-2026-9853 — A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the...
- CVE-2026-49467 — TOTP enrollment hijack: password gate skipped due to unawaited promise
- CVE-2026-66411 — DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket...
- CVE-2026-11430 — Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit
- CVE-2026-10050 — Digest authentication lossy encoding
- CVE-2026-59309 — vCenter authentication-bypass vulnerability
- CVE-2026-66028 — Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email