Subnet Solutions PowerSYSTEM Center: incorrect authorization and SQL injection flaws for authenticated users (CVSS 3.1 9.0, CVSS 4.0 9.4); fixed in PowerSYSTEM Center 2020 Update 30 and 2026 Update 1.1, per CISA
CISA published ICS advisory ICSA-26-307-01 on 3 November 2026 for two vulnerabilities in Subnet Solutions PowerSYSTEM Center.
According to CISA, CVE-2026-63017 (incorrect authorization) allows a low-privileged, authenticated user to access resources normally limited to administrators, and CVE-2026-63774 (insufficient input validation in the report designer) allows an authenticated user to execute unauthorized SQL commands; CISA rates each 9.0 under CVSS 3.1 and 9.4 under CVSS 4.0. CISA lists PowerSYSTEM Center 2020 up to 5.29.x as affected by CVE-2026-63017, and PowerSYSTEM Center 2024 (6.0.x to 6.2.x) and 2026 (7.0.x to 7.1.x) as affected by both.
CISA says the vulnerabilities are not exploitable remotely and that no known public exploitation targeting them has been reported to CISA. CISA lists the product as deployed worldwide in the critical manufacturing and energy sectors.
Chinmay Patel of Digital Boundary Group and Subnet Solutions reported the vulnerabilities to CISA. (source: CISA ICSA-26-307-01)
- Product
- Subnet Solutions PowerSYSTEM Center
- Versions
- Per CISA (3 Nov 2026): PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017); PowerSYSTEM Center 2024 >=6.0.x and <=6.2.x (CVE-2026-63017, CVE-2026-63774); PowerSYSTEM Center 2026 >=7.0.x and <=7.1.x (CVE-2026-63017, CVE-2026-63774).
- CVSS
- (CVSS 3.1) / 9.4 (CVSS 4.0), per CISA, for each of CVE-2026-63017 and CVE-2026-63774
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; CVSS:4.0/AT:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Exploited in Australia?
- unknown
- Patch to
- Per Subnet Solutions via CISA: PowerSYSTEM Center 2020 users update to 2020 Update 30; 2024 users upgrade to PowerSYSTEM Center 2026 Update 1.1; 2026 users update to 2026 Update 1.1. If unable to update, monitor user activity records and disable PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools. Vendor support: support@subnet.com.