Hitachi Energy MicroSCADA X SYS600 Vulnerabilities (CVE-2026-9852/9853/9854): ICS Detection and Remediation Guide

CISA has published ICSA-26-293-04, disclosing multiple vulnerabilities in Hitachi Energy's MicroSCADA X SYS600 platform — the SCADA/EMS software used by electric utilities worldwide to monitor and control power transmission and distribution networks. The advisory covers CVE-2026-9852, CVE-2026-9853, and CVE-2026-9854, with the highest scoring issue rated CVSS v3 7.8 (High). The disclosed weakness classes are Improper Neutralization of Formula Elements in a CSV File (CSV/Formula Injection) and Incorrect Implementation of Authentication Algorithm.

If you operate MicroSCADA X SYS600 version 10.7 or earlier, or version 10.8, you are in scope. Given that this product sits directly in the operational path of grid monitoring and control for the Energy sector, these are not theoretical bugs — an authentication weakness in a SCADA server combined with a client-side code execution primitive is a chain an adversary will happily assemble.

Technical Analysis

Affected Products and Versions

• Hitachi Energy MicroSCADA X SYS600 — version 10.7 and earlier
• Hitachi Energy MicroSCADA X SYS600 — version 10.8
• Critical Infrastructure Sector: Energy (electric power transmission and distribution operators, utilities, independent system operators)
• Maximum CVSS: 7.8 (High) — locally/operationally exploitable with meaningful integrity and availability impact in an OT context

The Vulnerabilities

1. CSV Formula Injection (CWE-1236 — Improper Neutralization of Formula Elements in a CSV File)

SYS600, like most SCADA platforms, allows operators and engineers to export event logs, alarm histories, measurement data, and configuration reports to CSV for analysis. When user-controllable field values (for example, alarm text, object names, or source identifiers influenced by an attacker via protocol traffic) are written into a CSV export without sanitizing leading characters (=, +, -, @), the resulting file becomes a weaponized spreadsheet. The moment an engineer opens that CSV in Microsoft Excel — the universal workflow in OT engineering environments — the formula executes. Classic payloads include DDE / HYPERLINK-based exfiltration and, in legacy configurations, cmd execution via DDE.

The attacker doesn't need shell on the SCADA server for this one. They need to influence a string that ends up in an exported field, then wait for the routine, human, trusted step: an engineer exporting and opening a report. This is a client-side execution primitive delivered through a trusted OT workflow, which is exactly why it scores 7.8 — the blast radius lands on the engineering workstation, often the most privileged asset in the OT network.

2. Incorrect Implementation of Authentication Algorithm (CWE-303)

An authentication algorithm implemented incorrectly in a SCADA product typically means one or more of: predictable or replayable authentication tokens, a verification routine that fails open under malformed input, or credential material that can be derived or bypassed without the valid secret. In the SYS600 context, the practical concern is that a network-reachable attacker — or an attacker who has already pivoted into the OT DMZ — could authenticate to SYS600 services or inter-system communication channels without valid credentials.

How an Attack Chains Together

From a defender's perspective, the realistic kill chain:

1. Adversary gains foothold in IT or the OT DMZ (phishing, VPN, third party — the usual).
2. The authentication flaw is used to interact with SYS600 services without valid credentials — reading process data, issuing commands, or injecting crafted values into data fields.
3. Crafted values containing spreadsheet formulas are injected into alarm/event/object name fields.
4. An operator or engineer performs a routine CSV export and opens it in Excel on the engineering workstation.
5. The formula executes in the context of the engineer — a privileged OT user — yielding code execution or credential exfiltration deeper into the control network.

That is an IT-to-OT pivot with a human-in-the-loop detonator. It requires no zero-days beyond what is disclosed here.

Exploitation Status

As of the advisory publication there is no confirmed public proof-of-concept exploit and no confirmed in-the-wild exploitation, and none of these CVEs appear on the CISA Known Exploited Vulnerabilities (KEV) catalog at time of writing. That status is a window, not a comfort — ICS advisories historically see PoC development within weeks of publication, particularly for products with documented protocol behavior like SYS600. Treat this as patch-now.

Detection & Response

The observable surface for this threat cluster concentrates in two places: engineering workstations (where weaponized CSVs detonate) and the network perimeter around SYS600 servers (where unauthenticated interaction attempts would manifest). The detections below are tuned to fire on the post-exploitation behaviors, not the vulnerability itself — that's what makes them survivable in a real SOC.

Sigma Rules

---
title: Office Application Spawning Child Process After CSV Open - CSV Formula Injection Execution
id: 3f8c2a71-6b1e-4d59-9c02-7e4a5f8d6b31
status: experimental
description: Detects Microsoft Excel or other Office applications spawning command interpreters, scripting engines, or download cradles. Consistent with detonation of a CSV formula injection payload (DDE/cmd execution) exported from a SCADA/EMS platform such as Hitachi Energy MicroSCADA X SYS600 (CVE-2026-9852/9853/9854, ICSA-26-293-04).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\excel.exe'
      - '\winword.exe'
      - '\powerpnt.exe'
      - '\msaccess.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Excel add-in or macro automation in engineering environments - baseline per engineering workstation role
level: high
---
title: Spreadsheet-Style Formula Payload in Command Line of Office Child Process
id: 91d4e6c2-3a7b-48f0-b5e1-2c9d8a4f7e65
status: experimental
description: Detects command lines containing DDEAUTO, HYPERLINK, or formula-injection markers executed under an Office parent. Targets the execution stage of CSV formula injection from tainted SCADA report exports (ICSA-26-293-04).
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04
  - https://attack.mitre.org/techniques/T1559/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1559
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'DDEAUTO'
      - 'dde '
      - '| /c cmd'
      - 'HYPERLINK("http'
  filter_legit:
    ParentImage|endswith:
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legacy DDE-based integrations between Excel and vendor applications (some OT historian tools use DDE) - inventory before deploying at high level
level: high
---
title: Unexpected Outbound Connection to IEC 60870-5-104 from Non-SCADA Host
id: b6e21f48-9c3d-4a17-8d5b-4f0a2e6c9d72
status: experimental
description: Detects network connections to the IEC 60870-5-104 port (2404) initiated from hosts outside the expected SCADA client/server set. Combined with the authentication algorithm flaw in MicroSCADA X SYS600 (CVE-2026-9852/9853/9854), unexpected IEC-104 traffic may indicate unauthenticated interaction with the SCADA server.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04
  - https://attack.mitre.org/techniques/T0869/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.ics
  - attack.t0869
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 2404
  filter_scada:
    Image|endswith:
      - '\sys600.exe'
      - '\sctools.exe'
  condition: selection and not filter_scada
falsepositives:
  - Legitimate engineering tools, protocol test harnesses, and historian connectors using IEC-104 - maintain an explicit allowlist of authorized source hosts and processes
level: medium

KQL — Microsoft Sentinel / Defender

This hunt combines the workstation-side detonation (Office child processes) with the network-side signal (unexpected IEC-104 traffic toward SCADA assets). Tune SCADASubnet to your actual OT/DMZ addressing before deploying.

let SCADASubnet = "10.20."; // REPLACE with your OT/DMZ subnet hosting SYS600 servers
let Lookback = 7d;
// Stage 1: CSV formula injection detonation on engineering workstations
let OfficeExec = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName has_any ("excel.exe", "winword.exe", "msaccess.exe")
| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe")
| project WSExecTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Stage 2: Unexpected IEC 60870-5-104 (port 2404) traffic toward SCADA assets
let IEC104Traffic = (union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort == 2404
    | where RemoteIP startswith SCADASubnet
    | project SrcTime=TimeGenerated, SrcDevice=DeviceName, SrcIP=LocalIP, DstIP=RemoteIP, InitiatingProcess=InitiatingProcessFileName),
    (CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DestinationPort == 2404
    | where DestinationIP startswith SCADASubnet
    | project SrcTime=TimeGenerated, SrcDevice=DeviceName, SrcIP=SourceIP, DstIP=DestinationIP, InitiatingProcess=ApplicationProtocol));
// Correlate: any host generating both signals within the window is a priority escalation
OfficeExec
| join kind=inner IEC104Traffic on $left.DeviceName == $right.SrcDevice
| project DeviceName, AccountName, WSExecTime, ProcessCommandLine, SrcTime, DstIP, InitiatingProcess
| order by WSExecTime desc;

Even if the join returns nothing (the common case), run each leg independently — the OfficeExec leg alone is a high-value, low-noise hunt on OT engineering workstations, and the IEC104Traffic leg will surface hosts talking IEC-104 that should not be.

Velociraptor VQL

For DFIR validation on a suspect engineering workstation — confirm whether Excel spawned anything and identify recently created CSV exports that warrant content inspection:

-- Hunt: Office-spawned processes and recent CSV exports on engineering workstations
-- Deploy as a multi-artifact collection across the OT workstation fleet

-- Leg 1: Process execution under Office parents (CSV injection detonation)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\\\(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|certutil)\.exe$'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE Exe =~ '(?i)\\\\(excel|winword|msaccess)\.exe$'
  )

-- Leg 2: Recently created CSV files in user profiles (candidate weaponized exports)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:/Users/*/Documents/**/*.csv')
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC
LIMIT 200

For any CSV identified in Leg 2 that predates a suspicious process in Leg 1, carve the file and grep for leading =, +, @, DDE, HYPERLINK, and cmd strings before allowing it back into circulation.

Remediation and Verification Script

This PowerShell performs three defender actions on engineering workstations: (1) disables Excel DDE — the primary execution channel for CSV formula payloads, (2) enables Excel's "always prompt for DDE/external content" behavior, and (3) inventories local SYS600 installation evidence so you can confirm which hosts run affected versions pending the vendor update.

#Requires -RunAsAdministrator
# Security Arsenal - ICSA-26-293-04 Mitigation Script
# Mitigates CSV formula injection execution channel on OT engineering workstations

# 1) Disable DDE server launch and lookup in Excel (per-user hive under current context)
$excelPaths = @(
    'HKCU:\Software\Microsoft\Office\16.0\Excel\Options',
    'HKCU:\Software\Microsoft\Office\15.0\Excel\Options'
)
foreach ($p in $excelPaths) {
    if (Test-Path $p) {
        New-ItemProperty -Path $p -Name 'DDEAllowed' -PropertyType DWord -Value 0 -Force | Out-Null
        New-ItemProperty -Path $p -Name 'DDECleaned' -PropertyType DWord -Value 1 -Force | Out-Null
        Write-Host "[+] DDE disabled: $p" -ForegroundColor Green
    }
}

# 2) Block DDE via Attack Surface Reduction-style GPO key (Excel) - forces prompt/deny for external content
$secPath = 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security'
if (-not (Test-Path $secPath)) { New-Item -Path $secPath -Force | Out-Null }
New-ItemProperty -Path $secPath -Name 'WorkbookLinkWarnings' -PropertyType DWord -Value 2 -Force | Out-Null
New-ItemProperty -Path $secPath -Name 'ExtensionHardening' -PropertyType DWord -Value 2 -Force | Out-Null
Write-Host "[+] Excel external-content hardening applied" -ForegroundColor Green

# 3) Inventory SYS600 installations and report versions for patch tracking
$found = Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)' -Recurse -Depth 3 -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'SYS600|MicroSCADA' }
if ($found) {
    $found | ForEach-Object { Write-Host "[!] SYS600 component found: $($_.FullName)" -ForegroundColor Yellow }
    Write-Host "[!] Verify installed version against Hitachi Energy advisory - <=10.7 and 10.8 are affected" -ForegroundColor Yellow
} else {
    Write-Host "[+] No local SYS600 components detected (server-side check still required)" -ForegroundColor Green
}

Write-Host "`nManual steps remaining: apply Hitachi Energy vendor update per ICSA-26-293-04; restrict network access to SYS600 services; brief operators on CSV handling."

Run this via your management plane across all OT engineering workstations and HMI operator consoles. For the SYS600 server itself, coordinate version verification with your OT change-control process.

Remediation

1. Apply the Hitachi Energy vendor update immediately. ICSA-26-293-04 includes the vendor's Recommended Immediate Actions with the remediation target versions. Obtain the update through Hitachi Energy's official support channel for SYS600 and follow your OT change-management process — but do not let change control become an excuse for a 90-day slide on a High-severity SCADA flaw. The advisory is published at: https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-04

2. Inventory every SYS600 instance now. Confirm versions across production, staging, and backup servers. Anything at 10.7 or earlier, or 10.8 is affected. Include disaster-recovery and training environments — adversaries don't distinguish.

3. Until patched, enforce compensating controls for the CSV injection path:

   • Disable DDE in Excel on all engineering workstations and operator consoles (script above).
   • Mandate that SCADA CSV exports are opened in a text editor or a sandboxed analysis host first — never directly in Excel on a production OT workstation.
   • Configure Excel Group Policy to block external data connections by default.

4. Compensate for the authentication flaw at the network layer:

   • Restrict network reachability to SYS600 services to explicitly authorized hosts via firewall rules and/or data diodes where appropriate.
   • Verify that IEC 60870-5-104 (port 2404), OPC, and any SYS600 inter-server channels are not reachable from general IT segments or jump hosts that don't require it.
   • Enable and centralize SYS600 authentication logging; alert on any authentication success from a non-baselined source.

5. Follow CISA's standing ICS guidance: minimize network exposure for control system devices, confirm they are not internet-accessible, and place control networks behind firewalls isolated from business networks. Scan your perimeter for any SYS600-related exposure (a quick Shodan-style review of your own ASN is a 30-minute task with outsized value).

6. Brief the humans. This vulnerability class detonates through a routine operator workflow. A 15-minute briefing to engineering and operations staff — "don't open SCADA CSV exports directly in Excel this quarter" — closes the execution channel faster than any patch cycle.

The Bottom Line

CVE-2026-9852/9853/9854 in MicroSCADA X SYS600 is a patch-now event for any energy-sector operator running version 10.8 or earlier. The combination of an authentication implementation flaw and a client-side CSV injection primitive is a ready-made IT-to-OT pivot. Patch per the vendor advisory, harden the Excel attack surface on engineering workstations, lock down network reachability to SYS600 services, and deploy the detections above as interim tripwires. No confirmed exploitation today — that is the time to move, not the reason to wait.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub