CVE-2026-9852: Microsoft Windows vulnerability
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
Affected Software
Event History
Frequently Asked Questions
Does user privilege level limit exposure?
No. The issue affects Windows users regardless of privilege level if they can run the Notify service and export the log.
What capability does an attacker need to exploit this issue?
The attacker needs a way to create arbitrary log messages. The available paths include normal functionality through SCIL scripts, a log injection vulnerability, or the SYS600 broker.
Is merely viewing a log enough to trigger the issue?
The affected workflow described is exporting the log and opening the resulting spreadsheet content. The impact of malicious formulas, including possible code execution, can depend on the user's environment configuration.