CVE-2026-9853High· 7.8▾ TwilightA vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.1%
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself.
Only the SYS600 system users should be permitted to view and modify application objects.
microscada_x_sys600 >= 10.0, <= 10.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9854High· 7.8A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
CVE-2026-9852High· 7.8A CSV injection vulnerability exists in SYS600
CVE-2026-101728Medium· 6.5mysql: mysql: Denial of Service in Pluggable Auth (CVE-2026-101728)
CVE-2026-101774Medium· 6.5mysql: mysql: Denial of service via Pluggable Authentication component (CVE-2026-101774)
CVE-2026-86589NoneApache Answer: User Center integration does not revoke first-login sessions after central account suspension
CVE-2026-68300Critical· 9.8sctp: auth: verify auth requirement when auth_chunk is NULL