CISA has warned about two critical PowerSYSTEM Center flaws with CVSS 9.0 scores that could let authenticated users reach administrator resources or run unauthorized database commands. The issue affects energy and manufacturing sectors worldwide, and the advisory says the vulnerabilities are not remotely exploitable.
The agency issued advisory ICSA-26-307-01 on November 3, 2026. CISA credited Chinmay Patel of Digital Boundary Group and Subnet Solutions with reporting the vulnerabilities. The Canadian vendor provided upgrade guidance and temporary measures for organizations that cannot immediately update affected systems.
Unauthorized access in PowerSYSTEM Center
The first flaw is CVE-2026-63017, which is tracked as CWE-863. It involves incorrect authorization and allows a user with limited permissions to access resources that should be reserved for administrators. In practice, a basic account does not keep the user within the access limits intended for that account.
CVE-2026-63017 affects PowerSYSTEM Center 2020 versions through 5.29.x, PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x, and PowerSYSTEM Center 2026 versions 7.0.x through 7.1.x. The advisory does not list the 2020 branch as affected by SQL injection. The CVSS vectors describe low attack complexity, low privileges, no required user interaction, and an adjacent attack vector rather than unrestricted network access.
SQL injection in the report designer
The second flaw is CVE-2026-63774, which is tracked as CWE-89. Insufficient input checks in the report designer allow an authenticated user to execute unauthorized SQL commands. The disclosed impact concerns database commands, and confirmed operating system code execution is not part of that finding.
CVE-2026-63774 affects the listed 2024 and 2026 ranges. CISA says no known public exploitation had been reported when the advisory was released. The agency also said the vulnerabilities were not remotely exploitable.
Vendor update path and interim limits
Subnet Solutions recommends PowerSYSTEM Center 2020 Update 30 for affected 2020 installations. Organizations running the 2024 branch should upgrade to PowerSYSTEM Center 2026 Update 1.1, and existing 2026 installations should also update to Update 1.1 according to CISA’s machine-readable advisory. Checking installed versions is essential before planning upgrades.
For organizations unable to update, Subnet recommends monitoring user activity records and restricting Client Access Server users’ access to browser F12 Developer Tools to reduce authorization-related risk. For the SQL injection issue, the vendor recommends restricting user access to the report designer. These are interim measures, and they do not replace the recommended updates.
Operational guidance for control systems
CISA also advises keeping control systems off the public internet, placing them behind firewalls, and separating them from business networks. Where remote access is necessary, organizations should use updated VPNs and assess connected devices. Before applying changes, operators should assess operational impact and risk, follow internal response procedures for suspected malicious activity, and report it to CISA.
Cybersecurity News previously covered CISA’s OT asset inventory guidance, which explains how accurate device and software records support vulnerability management across industrial environments.
Licensed under CC BY-ND 4.0 International