Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01) · updates https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01 CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions. en Tue, 03 Nov 2026 00:00:00 GMT Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01): CISA publishes ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center: incorrect authorization (CVE-2026-63017) and report-designer SQL injection (CVE-2026-63774), both CVSS 3.1 9.0 adjacent; fixes in 2020 Update 30 and 2026 Update 1.1; no known public exploitation and not remotely exploitable. https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01 https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01#2026-11-03-1ce44e8a Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01">Source</a></p>