CISA has published advisory ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center, a platform used by utilities and manufacturers to manage field devices. Both vulnerabilities are rated critical.
The vulnerabilities
- CVE-2026-63017 (incorrect authorization): a low-privileged, logged-in user can reach resources meant only for administrators.
- CVE-2026-63774 (SQL injection): weak input validation in the report designer lets a logged-in user run unauthorized database commands.
Each scores 9.0 under CVSS v3.1 and 9.4 under v4.0. Both need an authenticated user, and CISA states they are not exploitable remotely. No exploitation has been reported.
Affected versions
- PowerSYSTEM Center 2020: version 5.29.x and earlier
- PowerSYSTEM Center 2024: versions 6.0.x to 6.2.x
- PowerSYSTEM Center 2026: versions 7.0.x to 7.1.x
Fixes and workarounds
- 2024 and 2026 releases: upgrade to PowerSYSTEM Center 2026 Update 1.1.
- 2020 release: apply Update 30.
- Until then: disable user access to the report designer, and disable browser developer tools for Client Access Server users.
- Where updating is not possible, review user activity records.
Why it deserves attention
A system that holds device configurations and access for substation equipment is a high-value target for anyone who already has a foothold. “Requires a valid account” is a weaker barrier than it sounds where accounts are shared between shifts or with contractors. Treat this as a prompt to review who has accounts on the platform and whether each one is still needed.
The flaws were reported by Chinmay Patel of Digital Boundary Group and by the vendor.