Advisories › Subnet Solutions › ICSA-26-307-01
Subnet Solutions PowerSYSTEM Center: 2 CVEs, Critical 9.0
Summary
CISA reports 2 vulnerabilities in Subnet Solutions PowerSYSTEM Center 2020, PowerSYSTEM Center 2024, PowerSYSTEM Center 2026. Weakness types: Incorrect Authorization, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources. Highest CVSS v3 score: 9.0 (Critical), exploitable from an adjacent network.
What to do: Prioritize: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1.
At a glance
- Vendor
- Subnet Solutions
- Products
- PowerSYSTEM Center 2020, PowerSYSTEM Center 2024, PowerSYSTEM Center 2026
- CVEs
- CVE-2026-63017, CVE-2026-63774
- Highest CVSS v3
- 9.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy
- Deployed
- Worldwide
- Vendor HQ
- Canada
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-63017 | Incorrect Authorization | 9.0 | – | No | Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators. |
| CVE-2026-63774 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 9.0 | – | No | Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands. |
Affected products (3)
- Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x
- Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x
- Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x
Vendor fixes and mitigations (from advisory)
- Mitigation: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to acc
- Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
- Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
- Mitigation: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.
- Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.