CISA Discloses Two Critical Authorization and SQL Injection Flaws in Subnet Solutions PowerSYSTEM Center
CISA published advisory ICSA-26-307-01 on two vulnerabilities affecting Subnet Solutions PowerSYSTEM Center, a platform used by energy and critical manufacturing operators to manage grid equipment worldwide. CVE-2026-63017 is an incorrect authorization flaw (CWE-863) that lets a low-privileged, authenticated user on an adjacent network access resources normally limited to administrators. CVE-2026-63774 is a SQL injection flaw (CWE-89) in the report tool that lets an authenticated user run unauthorized SQL commands and alter stored data. Both flaws were reported to CISA by the vendor itself, with Chinmay Patel of Digital Boundary Group credited alongside the vendor's team. CISA states the vulnerabilities are not remotely exploitable and that no public exploitation has been reported at this time.
Entenda a falha
A vulnerabilidade
Two flaws affect Subnet Solutions PowerSYSTEM Center, a platform used by energy and critical manufacturing operators to manage grid equipment. CVE-2026-63017 is an incorrect authorization flaw (CWE-863), rated CVSS v4 9.4: a low-privileged authenticated user on an adjacent network can reach resources meant for administrators. It affects 2020 up to 5.29.x, 2024 6.0.x-6.2.x and 2026 7.0.x-7.1.x. CVE-2026-63774 is a SQL injection (CWE-89) in the report tool: an authenticated user can run unauthorized SQL commands and alter stored data, on the 2024 and 2026 branches. Fixes are 2020 Update 30 and 2026 Update 1.1; 2024 users should move to 2026 Update 1.1.
Como funciona
For CVE-2026-63017, an authenticated low-privileged user on an adjacent network makes requests to the platform, and the software grants access to administrator-only resources instead of refusing it. For CVE-2026-63774, a logged-in user supplies input to the report tool, which uses it in a database query. The input is not properly neutralized, so the database treats it as SQL commands and not as plain data, and stored data can be changed. The articles do not give finer detail on the code path.
Por que é vulnerável
CVE-2026-63017 is a flawed authorization check (CWE-863): the software does not correctly enforce which privilege level may reach which resources. CVE-2026-63774 is a classic input-validation failure (CWE-89) in the report tool, where user input is not properly checked before reaching the database. The articles do not describe why these went unnoticed or what exactly the patches change.
Como foi descoberta
According to the articles, both flaws were reported to CISA by the vendor itself, with Chinmay Patel of Digital Boundary Group credited alongside the vendor's team. CISA published them in advisory ICSA-26-307-01. CISA states the flaws are not remotely exploitable and that no public exploitation targeting them has been reported to it. The articles do not say how the flaws were found.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 00:17.
Detalhes técnicos
CISA rates the authorization bypass CVE-2026-63017 at CVSS v4 9.4 (critical), affecting PowerSYSTEM Center 2020 builds up to 5.29.x, 2024 builds 6.0.x–6.2.x, and 2026 builds 7.0.x–7.1.x. CVE-2026-63774 (SQL injection) affects the 2024 and 2026 branches only. The article's cited score of "9.0" corresponds to a CVSS v3.1 base score reported by third-party trackers (thehackerwire.com), while CISA's own advisory lists the highest severity as 9.4 under CVSSv4.
Detalhes da correção
Subnet Solutions released PowerSYSTEM Center 2020 Update 30 and PowerSYSTEM Center 2026 Update 1.1 to remediate both flaws (cisa.gov). Users on the 2024 branch are advised to upgrade directly to PowerSYSTEM Center 2026 Update 1.1, as no dedicated 2024 patch is listed (cisa.gov).
Remediação
Organizations unable to patch immediately should disable user access to the report designer/report tool, disable Client Access Server users' ability to use browser F12 developer tools, and monitor user activity records (cisa.gov, assurantcyber.com). CISA further recommends general control-system network segmentation, isolating industrial control systems and SCADA networks from business networks and the internet behind firewalls, and using secure VPNs for any required remote access.
Relatos divergentes
The article reports a CVSS score of "9.0" for both CVEs, which reflects a CVSSv3.1 base score; CISA's advisory instead lists the vulnerabilities' highest CVSSv4 severity as 9.4 (critical) (cisa.gov).
Linha do tempo
-
CISA Discloses Two Critical Authorization and SQL Injection Flaws in Subnet Solutions PowerSYSTEM Center
ler a análise desta fonte ocultar
CISA published advisory ICSA-26-307-01 on two vulnerabilities affecting Subnet Solutions PowerSYSTEM Center, a platform used by energy and critical manufacturing operators to manage grid equipment worldwide. CVE-2026-63017 is an incorrect authorization flaw (CWE-863) that lets a low-privileged, authenticated user on an adjacent network access resources normally limited to administrators. CVE-2026-63774 is a SQL injection flaw (CWE-89) in the report tool that lets an authenticated user run unauthorized SQL commands and alter stored data. Both flaws were reported to CISA by the vendor itself, with Chinmay Patel of Digital Boundary Group credited alongside the vendor's team. CISA states the vulnerabilities are not remotely exploitable and that no public exploitation has been reported at this time.
Technical Details
CISA rates the authorization bypass CVE-2026-63017 at CVSS v4 9.4 (critical), affecting PowerSYSTEM Center 2020 builds up to 5.29.x, 2024 builds 6.0.x–6.2.x, and 2026 builds 7.0.x–7.1.x. CVE-2026-63774 (SQL injection) affects the 2024 and 2026 branches only. The article's cited score of "9.0" corresponds to a CVSS v3.1 base score reported by third-party trackers (thehackerwire.com), while CISA's own advisory lists the highest severity as 9.4 under CVSSv4.
Fix Details
Subnet Solutions released PowerSYSTEM Center 2020 Update 30 and PowerSYSTEM Center 2026 Update 1.1 to remediate both flaws (cisa.gov). Users on the 2024 branch are advised to upgrade directly to PowerSYSTEM Center 2026 Update 1.1, as no dedicated 2024 patch is listed (cisa.gov).
Remediation
Organizations unable to patch immediately should disable user access to the report designer/report tool, disable Client Access Server users' ability to use browser F12 developer tools, and monitor user activity records (cisa.gov, assurantcyber.com). CISA further recommends general control-system network segmentation, isolating industrial control systems and SCADA networks from business networks and the internet behind firewalls, and using secure VPNs for any required remote access.
Conflicting Reports
The article reports a CVSS score of "9.0" for both CVEs, which reflects a CVSSv3.1 base score; CISA's advisory instead lists the vulnerabilities' highest CVSSv4 severity as 9.4 (critical) (cisa.gov).