Subnet
Security incidents tagged Subnet. Newest first.
1 Subnet incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 3
- Longest quiet run: 3 days (Nov 4–Nov 6)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Subnet Solutions PowerSYSTEM Center: authz bypass and report-designer SQLi (ICSA-26-307-01)
CISA ICSA-26-307-01 covers two critical flaws in Subnet Solutions PowerSYSTEM Center (ICS/OT software used in energy and critical manufacturing). CVE-2026-63017 is incorrect authorization that lets a low-privileged authenticated user reach administrator-only resources (CVSS 3.1 9.0, AV:A). CVE-2026-63774 is SQL injection in the report designer that lets an authenticated user run unauthorized SQL (CVSS 3.1 9.0, AV:A). PowerSYSTEM Center 2020 through 5.29.x is affected by the authz bug; 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x are affected by both. Fixes: 2020 Update 30, or upgrade 2024/2026 lines to PowerSYSTEM Center 2026 Update 1.1. CISA says there is no known public exploitation and the bugs are not remotely exploitable (adjacent network). Unpatched mitigations: monitor user activity and disable F12 DevTools for Client Access Server users (authz); disable report-designer access (SQLi). Reported to CISA by Chinmay Patel (Digital Boundary Group) and by Subnet Solutions.
Subnet Solutions PowerSYSTEM CenterSince Nov 3, 2026
