Critical SQL Injection & Authorization Bypass in Subnet Solutions PowerSYSTEM Center (CVE‑2026‑63017, CVE‑2026‑63774)
What It Is — The U.S. Cybersecurity & Infrastructure Security Agency (CISA) issued an Industrial Control Systems Advisory (ICS‑A‑26‑307‑01) reporting two critical flaws in Subnet Solutions PowerSYSTEM Center.
- CVE‑2026‑63017 – An “incorrect authorization” defect that lets a low‑privileged, authenticated user reach resources normally reserved for administrators.
- CVE‑2026‑63774 – An SQL‑injection vulnerability that permits an attacker to execute arbitrary SQL commands against the backend database.
Both flaws receive a CVSS v3.1 base score of 9.0 (Critical). A successful exploit could allow unauthorized data manipulation, privilege escalation, and broader system compromise across the PowerSYSTEM Center versions:
| Affected versions | Vulnerability |
|-------------------|---------------|
| PowerSYSTEM Center 2020 ≤ 5.29.x | CVE‑2026‑63017 |
| PowerSYSTEM Center 2024 ≥ 6.0.x ≤ 6.2.x | CVE‑2026‑63017, CVE‑2026‑63774 |
| PowerSYSTEM Center 2026 ≥ 7.0.x ≤ 7.1.x | CVE‑2026‑63017, CVE‑2026‑63774 |
The advisory notes deployments in critical manufacturing and energy sectors worldwide. Subnet Solutions recommends upgrading to PowerSYSTEM Center 2026 Update 1.1 and contacting their system integrators for assistance.
Affected Products — Subnet Solutions PowerSYSTEM Center (2020 ≤ 5.29.x, 2024 ≥ 6.0.x ≤ 6.2.x, 2026 ≥ 7.0.x ≤ 7.1.x).
Why It Matters for Trust & Control Assurance — The flaws directly violate the access‑control control objective: ensuring that only authorized identities can perform privileged actions. Capability focus: ACCESS_CONTROLS.
Recommended Actions
- Verify current PowerSYSTEM Center version.
- Apply the vendor‑provided upgrade to PowerSYSTEM Center 2026 Update 1.1 immediately.
- Conduct a privileged‑access review to confirm that low‑privilege accounts cannot reach admin‑only resources.
- Deploy web‑application firewalls or input‑validation controls to mitigate SQL‑injection attempts.
- Enable detailed audit logging for all database queries and privileged‑access events.