# Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01) · pwn.watch

> CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions.

Page: https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01 · generated 2026-11-06T05:18:15.303Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Subnet Solutions PowerSYSTEM Center
- Started: 2026-11-03
- CVEs: CVE-2026-63017, CVE-2026-63774
- Affected: PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017); PowerSYSTEM Center 2024 6.0.x–6.2.x (CVE-2026-63017, CVE-2026-63774); PowerSYSTEM Center 2026 7.0.x–7.1.x (CVE-2026-63017, CVE-2026-63774)
- Fixed in: PowerSYSTEM Center 2020 Update 30; PowerSYSTEM Center 2026 Update 1.1 (for 2024 and 2026 lines)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/feed.xml
- JSON Feed: https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01.json
- This file: https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01/llms.txt

## Updates (newest first)
- 2026-11-03: CISA publishes ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center: incorrect authorization (CVE-2026-63017) and report-designer SQL injection (CVE-2026-63774), both CVSS 3.1 9.0 adjacent; fixes in 2020 Update 30 and 2026 Update 1.1; no known public exploitation and not remotely exploitable. (https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01)

## Fix brief
# Security brief: Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01)

Source: https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01 · status: live · severity: critical · updated Nov 6, 2026, 03:43 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions.

Severity detail: CVSS 3.1 9.0 (AV:A) for both CVE-2026-63017 and CVE-2026-63774; adjacent network, not remotely exploitable; no known public exploitation (CISA)

- Product: Subnet Solutions PowerSYSTEM Center
- CVE / advisory ids: CVE-2026-63017, CVE-2026-63774

## Affected versions
- PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017)
- PowerSYSTEM Center 2024 6.0.x–6.2.x (CVE-2026-63017, CVE-2026-63774)
- PowerSYSTEM Center 2026 7.0.x–7.1.x (CVE-2026-63017, CVE-2026-63774)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- PowerSYSTEM Center 2020 Update 30
- PowerSYSTEM Center 2026 Update 1.1 (for 2024 and 2026 lines)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
If you run PowerSYSTEM Center: upgrade 2020 to Update 30, or move 2024/2026 installs to 2026 Update 1.1. Until then, monitor user activity, disable F12 DevTools for Client Access Server users, and disable report-designer access. Keep the product off the public internet (adjacent-only per CISA).

## Latest updates
- Nov 3, 2026: CISA publishes ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center: incorrect authorization (CVE-2026-63017) and report-designer SQL injection (CVE-2026-63774), both CVSS 3.1 9.0 adjacent; fixes in 2020 Update 30 and 2026 Update 1.1; no known public exploitation and not remotely exploitable.

## Advisories
- [Subnet Solutions PowerSYSTEM Center (ICSA-26-307-01)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01) (CISA)

## Caveats
Acknowledgments: Chinmay Patel of Digital Boundary Group and Subnet Solutions reported these vulnerabilities to CISA. Do not cite cve.now.

---
Machine-readable: https://pwn.watch/i/subnet-powersystem-center-authz-sqli-icsa-26-307-01.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.