Summary
- CISA has published an advisory covering two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center, affecting versions spanning the 2020, 2024, and 2026 product lines.
- CVE-2026-63017 allows a low-privileged authenticated user to access administrator-restricted resources due to incorrect authorisation controls.
- CVE-2026-63774 enables an authenticated user to execute arbitrary SQL commands via the product’s report designer, owing to insufficient input validation.
- Both vulnerabilities score 9.0 under CVSS 3.1 and 9.4 under CVSS 4.0; exploitation requires adjacent network access and low-level credentials but no user interaction.
- No known public exploitation has been reported to CISA at this time, and the vulnerabilities are not remotely exploitable.
What Has Been Disclosed
CISA published an advisory on 3 November 2026 covering two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center, a platform used in critical manufacturing and energy sector environments worldwide. The vulnerabilities were reported to CISA by Chinmay Patel of Digital Boundary Group and by Subnet Solutions itself.
The Vulnerabilities in Detail
The first flaw, CVE-2026-63017, is an incorrect authorisation issue classified under CWE-863. It allows a low-privileged, authenticated user to access resources that should be restricted to administrators. This affects all three affected product generations: PowerSYSTEM Center 2020 at version 5.29.x and below, the 2024 line from 6.0.x through 6.2.x, and the 2026 line from 7.0.x through 7.1.x.
The second flaw, CVE-2026-63774, is a SQL injection vulnerability classified under CWE-89. Insufficient input validation in the product’s report designer allows an authenticated user to execute unauthorised SQL commands against the underlying database. This affects the 2024 and 2026 product lines within the same version ranges; the advisory does not list a confirmed remediation path for the 2020 line under this specific CVE.
Severity and Attack Conditions
Both vulnerabilities carry a CVSS 3.1 base score of 9.0 (Critical) and a CVSS 4.0 score of 9.4 (Critical). The attack vector in both cases is adjacent network access, meaning an attacker must already have a foothold on the same network segment. Low-level credentials are required, but no user interaction and no special attack complexity are needed. The scope is rated as changed, meaning a successful exploit could affect components beyond PowerSYSTEM Center itself.
Recommended Remediation
Subnet Solutions recommends operators on the 2020 line upgrade to PowerSYSTEM Center 2020 Update 30. Those on the 2024 and 2026 lines are advised to upgrade to PowerSYSTEM Center 2026 Update 1.1. Organisations that cannot immediately patch are advised to monitor user activity logs, disable access to the browser’s F12 Developer Tools within the Client Access Server, and — specifically for the SQL injection issue — disable user access to the report designer until a patch is applied.
Broader Network Controls
CISA’s recommended practices for industrial control system environments remain relevant here. Control system networks should be positioned behind firewalls and isolated from business networks. Where remote access is necessary, VPNs should be used and kept current, with the understanding that a VPN’s security is only as strong as the devices connected to it. Internet-facing exposure for control system devices should be eliminated where possible.
Why it matters
PowerSYSTEM Center is deployed across energy and critical manufacturing environments globally — sectors that represent high-consequence targets. The combination of a privilege escalation flaw and a SQL injection vulnerability in the same product means that even a standard user account could be leveraged to traverse administrative boundaries and manipulate the underlying database. While exploitation requires adjacent network access rather than internet-facing exposure, that condition is not an unusual one in environments where contractors, vendors, and operational staff share network segments. CISOs overseeing OT or hybrid IT/OT environments should treat these as urgent patch candidates and validate that network segmentation controls are functioning as intended.
What to do now
- Identify all instances of PowerSYSTEM Center 2020 at or below version 5.29.x and upgrade to PowerSYSTEM Center 2020 Update 30.
- Identify all instances of PowerSYSTEM Center 2024 (6.0.x–6.2.x) and PowerSYSTEM Center 2026 (7.0.x–7.1.x) and upgrade to PowerSYSTEM Center 2026 Update 1.1.
- Contact Subnet Solutions support at support@subnet.com or (403) 270-8885 for upgrade assistance if required.
- If immediate patching is not possible, monitor user activity records within the application for anomalous behaviour.
- Disable Client Access Server users’ ability to access F12 Developer Tools in the browser as an interim control for the authorisation vulnerability.
- Disable user access to the report designer as an interim control for the SQL injection vulnerability.
- Confirm that PowerSYSTEM Center instances are not accessible from the internet and are isolated from general business networks behind appropriate firewalls.
- Review VPN configurations used for remote access to control system networks and ensure they are running current versions.
