Do Son 
TL;DR
CISA warns of two critical bugs in Subnet Solutions PowerSYSTEM Center. Both CVE-2026-63017 and CVE-2026-63774 carry a high 9.0 score. Consequently, local attackers can bypass access rules. They can also run rogue database code.
- Product: Subnet Solutions (2 products)
- Vulnerabilities: 2 flaws (CVE-2026-63017, CVE-2026-63774)
- Highest severity: 9.4 (Critical · CVSSv4)
- Worst impact: PowerSYSTEM Center Incorrect Authorization
- Status: No confirmed exploitation yet; patches available
- Action: Update to Update 30, PowerSYSTEM Center 2026 Update 1.1, Update 1.1 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-63017 | 9.4 | PowerSYSTEM Center Incorrect Authorization | Update 30, PowerSYSTEM Center 2026 Update 1.1, Update 1.1 | Not exploited |
| CVE-2026-63774 | 9.4 | PowerSYSTEM Center SQL Injection | PowerSYSTEM Center 2026 Update 1.1, Update 1.1 | Not exploited |
Why It Matters
Subnet Solutions PowerSYSTEM Center helps power plants run grid gear. According to the CISA ICSA-26-307-01 advisory, firms use this tool in energy plants worldwide. In the alert, CISA states that “These vulnerabilities are not exploitable remotely.”
CISA also reports that “No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.” In addition, Chinmay Patel of Digital Boundary Group and the vendor team found both bugs. They shared their findings to help protect critical grids. While exact user counts remain private, many power networks rely on this platform every day.
How the Attack Works
Authorization Bypass and SQL Injection
First, CVE-2026-63017 stems from weak access rules (CWE-863). A low-level user on an adjacent network can view admin data. They can then open files meant only for root users. Next, CVE-2026-63774 involves poor input checks in the report tool (CWE-89). Thus, a logged-in user can run rogue database queries. They can then change stored data on the server.
Affected Versions
These bugs hit Subnet Solutions PowerSYSTEM Center 2020 builds up to 5.29.x. They also affect PowerSYSTEM Center 2024 versions 6.0.x to 6.2.x. In addition, they impact PowerSYSTEM Center 2026 builds 7.0.x to 7.1.x.
Patch and Mitigation Steps
Subnet Solutions shipped PowerSYSTEM Center 2026 Update 1.1 and 2020 Update 30 to fix these flaws. Admins should call support or email support@subnet.com to get the update. If teams cannot patch now, they should turn off user access to the report tool. Furthermore, admins should block browser developer tools in the Client Access Server. CISA also tells teams to keep all control networks behind firewalls. These steps help keep plant networks safe from harm.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
