Skip to content

Back to the catalog

cisa.govadvisory

Subnet Solutions PowerSYSTEM Center

CISA advisory ICSA-26-307-01 (3 November 2026) covers two vulnerabilities in Subnet Solutions PowerSYSTEM Center 2020, 2024 and 2026: CVE-2026-63017, incorrect authorization letting a low-privileged authenticated user reach admin-only resources, and CVE-2026-63774, SQL injection. Vendor CVSS v3 is 9. Subnet recommends upgrading to PowerSYSTEM Center 2026 Update 1.1, monitoring user activity and blocking F12 Developer Tools for Client Access Server users.

TL;DR CISA warns of an authorization bypass and SQL injection in Subnet Solutions PowerSYSTEM Center used in energy and manufacturing, with upgrade guidance.
Open original ↗

Organisations named here

  • CISA
  • Subnet Solutions

CVEs named here

  • CVE-2026-63017
  • CVE-2026-63774

Technologies named here

  • PowerSYSTEM Center
  • Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017)
  • Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x (CVE-2026-63017, CVE-2026-63774)
  • Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x (CVE-2026-63017, CVE-2026-63774)

Standards and laws named here

  • CVSS

Techniques named here

  • SQL injection
  • Incorrect authorization
  • Improper Neutralization of Special Elements used in an SQL Command

Concepts named here

  • Critical infrastructure exposure
  • CVSS v3 score

Related in AppSec