CVE-2026-9852
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user's machine. To exploit this issue attackers would need a way to create arbitrary log messages, achievable through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker.
Risk Assessment
The risk includes the possibility of executing malicious code on users' machines, potentially leading to system compromise, data theft, or malware spread.
Recommendation
Restrict the ability to create logs by unauthorized users and upgrade SYS600 to a patched version if available.
Other vulnerabilities in SYS600
See all- CVE-2026-9854High
A vulnerability in the RBAC mechanism of SYS600 allows users with access to engineering tools to elevate their privileges to administrator level on the underlying Windows host, granting full control over the machine.
- CVE-2026-9853High
A vulnerability in SYS600 allows any user authenticated to the operating system of the hosting server to read and modify application objects without being authenticated to the SYS600 system itself.
Original NVD description (English source)
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.