CISA warns of two CVSS 9.0 flaws in PowerSYSTEM Center
Original title: CISA Warns Two Critical 9.0 Flaws in PowerSYSTEM Center Allow Unauthorized Access and SQL Injection
Authenticated adjacent-network bugs allow admin-resource access or SQL commands; CISA says they are not remotely exploitable.
CISA advisory ICSA-26-307-01, released November 3, 2026, covers two critical PowerSYSTEM Center flaws affecting energy and manufacturing users. CVE-2026-63017 lets a low-privilege user reach administrator resources. CVE-2026-63774 lets an authenticated user run unauthorized SQL commands from the report designer. Both have low complexity and an adjacent attack vector. CISA said they are not remotely exploitable and that no public exploitation was known when the advisory was released. Subnet Solutions published upgrade paths and interim restrictions.
- Incorrect authorization is CVE-2026-63017 (CWE-863); SQL injection is CVE-2026-63774 (CWE-89).
- CVE-2026-63017 hits 2020 through 5.29.x, 2024 6.0.x–6.2.x, and 2026 7.0.x–7.1.x.
- SQL injection affects the listed 2024 and 2026 ranges, not the 2020 branch.
- 2020 users should install Update 30; 2024 and 2026 should move to 2026 Update 1.1.
- Chinmay Patel of Digital Boundary Group and Subnet Solutions reported the bugs.
Impact: Authenticated access to admin resources or unauthorized SQL commands
| Product | Affected | Fixed in |
|---|---|---|
| Subnet Solutions PowerSYSTEM Center 2020 | through 5.29.x | 2020 Update 30 |
| Subnet Solutions PowerSYSTEM Center 2024 | 6.0.x through 6.2.x | PowerSYSTEM Center 2026 Update 1.1 |
| Subnet Solutions PowerSYSTEM Center 2026 | 7.0.x through 7.1.x | Update 1.1 |
- 1.Install 2020 Update 30, or upgrade 2024 and 2026 systems to 2026 Update 1.1.
- 2.Restrict report-designer access and Client Access Server users’ browser developer tools.
- 3.Keep control systems off the public internet and separate them from business networks.
- Vendors
- Subnet Solutions
- Products
- PowerSYSTEM Center
- Organizations
- CISADigital Boundary Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63017+1 related CVE | Incorrect authorization in PowerSYSTEM Center allows low-privileged authenticated access | 9.4 | — |
From the original article
2 min read at cybersecuritynews.com
CISA warned that two critical PowerSYSTEM Center flaws (CVSS 9. 0) could let authenticated users access administrator resources or execute unauthorized database commands, affecting energy and manufacturing sectors worldwide. The agency released advisory ICSA-26-307-01 on November 3, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.