Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01)

CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions.

Why this severity: CVSS 3.1 9.0 (AV:A) for both CVE-2026-63017 and CVE-2026-63774; adjacent network, not remotely exploitable; no known public exploitation (CISA)

Started

Nov 3, 2026

CVEs

CVE-2026-63017CVE-2026-63774

• #Subnet
• #Powersystem Center
• #ICS/OT
• #Cisa
• #Energy
• SQL injection
• #Authz Bypass

Notes & caveats

Acknowledgments: Chinmay Patel of Digital Boundary Group and Subnet Solutions reported these vulnerabilities to CISA. Do not cite cve.now.