Subnet Solutions has fixed two critical flaws in PowerSYSTEM Center, its software used across the energy and critical manufacturing sectors, that let a logged-in user with limited rights reach administrator-only resources or run unauthorized SQL commands against the application. The flaws were disclosed in a CISA industrial control systems advisory, ICSA-26-307-01, published on November 3.
Both bugs score 9.0 under CVSS v3.1 and 9.4 under CVSS v4. CISA says no known public exploitation specifically targeting them has been reported to it, and that the vulnerabilities are not exploitable remotely. The published scoring vector assumes an attacker on an adjacent network who already holds a low-privileged account.
Two ways past the permission model
- CVE-2026-63017 (CVSS v3.1 9.0, v4 9.4). An incorrect authorization flaw lets a low-privileged, authenticated user access resources normally limited to administrators. It affects PowerSYSTEM Center 2020 up to 5.29.x, 2024 versions 6.0.x to 6.2.x, and 2026 versions 7.0.x to 7.1.x.
- CVE-2026-63774 (CVSS v3.1 9.0, v4 9.4). Insufficient input validation in the report designer lets an authenticated user execute unauthorized SQL commands, a SQL injection flaw. It affects the 2024 and 2026 lines listed above.
CISA lists the product as deployed worldwide, with the vendor headquartered in Canada. The advisory credits Chinmay Patel of Digital Boundary Group, as well as Subnet Solutions itself, with reporting the vulnerabilities. The vendor advisory and CISA's CSAF file carry the full technical detail.
An account is needed, which is not much comfort
Neither bug opens the door to a stranger on the internet. Both, however, let an ordinary account behave like a far more powerful one inside software that sits close to operational systems, which is why each carries a critical rating despite the access requirement.
Move to 2026 Update 1.1 or 2020 Update 30
- PowerSYSTEM Center 2026 users should update to 2026 Update 1.1.
- PowerSYSTEM Center 2024 users are told to upgrade to 2026 Update 1.1.
- PowerSYSTEM Center 2020 users should update to 2020 Update 30.
Where an update is not yet possible, Subnet Solutions recommends monitoring user activity records to make sure users follow acceptable usage policies and disabling Client Access Server users' access to the browser's F12 Developer Tools (for CVE-2026-63017), and disabling user access to the report designer (for CVE-2026-63774). CISA adds its standard guidance: keep control system devices off the internet, place them behind firewalls isolated from business networks, and use secured, up-to-date remote access where it is needed.
It is the latest in a run of industrial software fixes, following recent critical bugs in EPICS control software. For operators, the useful takeaway is the access model: in software like this, who holds an account matters as much as who can reach the network.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.