Upgrade affected versions: PowerSYSTEM Center 2020 to Update 30; PowerSYSTEM Center 2024 and 2026 to Update 1.1. As interim measures, monitor user activity records, disable F12 Developer Tools access for Client Access Server users, and restrict access to the report designer for CVE-2026-63774.
Quick answers
What is CVE-2026-63017?
Upgrade affected versions: PowerSYSTEM Center 2020 to Update 30; PowerSYSTEM Center 2024 and 2026 to Update 1.1. As interim measures, monitor user activity records, disable F12 Developer Tools access for Client Access Server users, and restrict access to the report designer for CVE-2026-63774.
How severe is CVE-2026-63017?
critical, CVSS 9.4
Is CVE-2026-63017 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-63017 be mitigated?
Upgrade affected versions: PowerSYSTEM Center 2020 to Update 30; PowerSYSTEM Center 2024 and 2026 to Update 1.1. As interim measures, monitor user activity records, disable F12 Developer Tools access for Client Access Server users, and restrict access to the report designer for CVE-2026-63774.
CVSS
9.4
Vendor
Subnet Solutions
Published
Nov 4, 2026 · 02:26
Patch
Unknown / not confirmed
Affected products
PowerSYSTEM Center 2020, PowerSYSTEM Center 2024, PowerSYSTEM Center 2026
Mitigation
Upgrade affected versions: PowerSYSTEM Center 2020 to Update 30; PowerSYSTEM Center 2024 and 2026 to Update 1.1. As interim measures, monitor user activity records, disable F12 Developer Tools access for Client Access Server users, and restrict access to the report designer for CVE-2026-63774.
CISA has issued an industrial control systems advisory (ICSA-26-307-01) disclosing two vulnerabilities in Subnet Solutions PowerSYSTEM Center. CVE-2026-63017 involves incorrect authorization allowing low-privileged authenticated users to access administrator-restricted resources. CVE-2026-63774 involves insufficient input validation in the report designer enabling SQL injection. Affected versions span PowerSYSTEM Center 2020 (<=5.29.x), 2024 (>=6.0.x and <=6.2.x), and 2026 (>=7.0.x and <=7.1.x). CVSS scores reach 9.4, classifying the flaws as critical. Subnet Solutions recommends upgrading to the latest update versions as the primary remediation.