{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01) · updates",
  "home_page_url": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01",
  "feed_url": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/feed.json",
  "description": "CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions.",
  "language": "en",
  "_pwn": {
    "slug": "subnet-powersystem-center-authz-sqli-icsa-26-307-01",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/feed.xml",
    "llms": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/llms.txt",
    "json": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01#2026-11-03-1ce44e8a",
      "url": "https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01#2026-11-03-1ce44e8a",
      "title": "Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01): CISA publishes ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center: incorrect authorization (CVE-2026-63017) and report-designer SQL injection (CVE-2026-63774), both CVSS 3.1 9.0 adjacent; fixes in 2020 Update 30 and 2026 Update 1.1; no known public exploitation and not remotely exploitable.",
      "content_text": "Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01): CISA publishes ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center: incorrect authorization (CVE-2026-63017) and report-designer SQL injection (CVE-2026-63774), both CVSS 3.1 9.0 adjacent; fixes in 2020 Update 30 and 2026 Update 1.1; no known public exploitation and not remotely exploitable.\n\nSource: https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01",
      "tags": [
        "critical"
      ]
    }
  ]
}