CVE-2026-9852
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Sep 3, 2026
CISA due date
—
The record
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
- CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
- CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236
- CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to… CWE-1236
- CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain… CWE-1236
- CVE-2026-47705 TypeBot is a chatbot builder tool. CWE-1236
- CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that… CWE-1236
- CVE-2026-65875 BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. CWE-1236