Two Critical Vulnerabilities Discovered in Subnet Solutions PowerSYSTEM Center
CISA alerts users to two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center, versions 2020, 2024, and 2026, potentially leading to unauthorized access and data breaches.
CISA has issued a warning regarding two critical vulnerabilities affecting Subnet Solutions PowerSYSTEM Center, a software used in critical manufacturing and energy sectors. The vulnerabilities, identified as CVE-2026-63017 and CVE-2026-63774, pose significant risks, including unauthorized administrative access and the execution of malicious SQL commands.
CVE-2026-63017, classified under Incorrect Authorization, allows a low-privileged, authenticated user to access resources that should be restricted to administrators. This could enable an attacker to escalate their privileges and gain deeper control over the system. The vulnerability impacts PowerSYSTEM Center versions 2020 (<=5.29.x), 2024 (>=6.0.x|<=6.2.x), and 2026 (>=7.0.x|<=7.1.x).
Compounding the risk, CVE-2026-63774, an SQL Injection vulnerability, permits authenticated users to execute unauthorized SQL commands. This flaw stems from insufficient input validation within the PowerSYSTEM Center's report designer. Successful exploitation could lead to data exfiltration, modification, or deletion, severely compromising the integrity and confidentiality of sensitive information.
The affected versions for CVE-2026-63774 include PowerSYSTEM Center 2024 (>=6.0.x|<=6.2.x) and 2026 (>=7.0.x|<=7.1.x). The combination of these vulnerabilities presents a severe threat landscape, with potential impacts ranging from data breaches to unauthorized resource access within critical infrastructure.
Subnet Solutions has provided specific remediation guidance for each affected version. For PowerSYSTEM Center 2024 and 2026, users are advised to upgrade to PowerSYSTEM Center 2026 Update 1.1. For users unable to upgrade immediately, Subnet Solutions recommends monitoring user activity logs and disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools. For PowerSYSTEM Center 2020, an update to PowerSYSTEM Center 2020 Update 30 is recommended.
For users of PowerSYSTEM Center 2024 and 2026 who cannot update, disabling user access to the report designer is also recommended as a mitigation for CVE-2026-63774. The company emphasizes contacting their System Integration team or customer support for assistance with upgrades.
Both vulnerabilities have received critical CVSS scores. CVE-2026-63017 has a CVSS v3.1 score of 9.0 (CRITICAL) and a CVSS v4.0 score of 9.4 (CRITICAL). CVE-2026-63774 also carries a CVSS v3.1 score of 9.0 (CRITICAL) and a CVSS v4.0 score of 9.4 (CRITICAL). These high scores underscore the urgency for organizations to apply the recommended patches and mitigations.
The widespread deployment of PowerSYSTEM Center across critical manufacturing and energy sectors globally means that these vulnerabilities could have far-reaching consequences. Organizations are urged to review their configurations and implement the necessary security updates to protect against potential exploitation.