Subnet Solutions PowerSYSTEM Center flaws patched
CISA details two authenticated vulnerabilities in Subnet Solutions PowerSYSTEM Center allowing privilege escalation and SQL injection; no known exploitation in the wild.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for Subnet Solutions PowerSYSTEM Center, a grid management product used in the critical manufacturing and energy sectors worldwide, with the vendor headquartered in Canada. Two vulnerabilities are disclosed: CVE-2026-63017, an incorrect authorization flaw (CWE-863) that lets a low-privileged authenticated user access resources normally restricted to administrators, and CVE-2026-63774, an SQL injection vulnerability (CWE-89) in the report designer component that allows an authenticated user to execute unauthorized SQL commands. Both issues require authenticated access and are not exploitable remotely, limiting the attack surface to insiders or attackers who have already obtained valid credentials.
Affected versions span PowerSYSTEM Center 2020 (<=5.29.x, CVE-2026-63017 only), 2024 (>=6.0.x to <=6.2.x, both CVEs), and 2026 (>=7.0.x to <=7.1.x, both CVEs). Subnet Solutions recommends upgrading to PowerSYSTEM Center 2026 Update 1.1 or PowerSYSTEM Center 2020 Update 30. Interim mitigations include monitoring user activity logs for policy violations, disabling browser F12 Developer Tools access for Client Access Server users, and restricting or disabling access to the report designer where upgrades are not immediately feasible.
CISA states there is no known public exploitation targeting these vulnerabilities at this time. The vulnerabilities were reported by Chinmay Patel of Digital Boundary Group and by Subnet Solutions itself. Standard ICS hardening guidance applies: minimize internet exposure of control system devices, isolate OT networks behind firewalls, and use VPNs with appropriate scrutiny for remote access.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs