Critical SQL Injection and Authorization Vulnerabilities Discovered in Subnet Solutions PowerSYSTEM Center

An advisory published by the Cybersecurity and Infrastructure Security Agency (CISA) on November 3, 2026, reveals two significant vulnerabilities affecting Subnet Solutions PowerSYSTEM Center, a software platform used for monitoring and managing electrical power systems and other critical infrastructure. The vulnerabilities are CVE-2026-63017 and CVE-2026-63774.

CVE-2026-63017 is described as an incorrect authorization flaw. A low-privileged, authenticated user could exploit this weakness to access resources normally limited to administrators. CVE-2026-63774 pertains to insufficient input validation within the PowerSYSTEM Center report designer. This flaw could allow an authenticated user to execute unauthorized SQL commands.

The combined CVSS v4.0 base score for the vulnerabilities is 9.4, with a critical severity rating. The CVSS v3.1 vector string is AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network-adjacent attack vector, low complexity, low-privileged attacker, and high impacts on confidentiality, integrity, and availability.

Affected product versions include:
- PowerSYSTEM Center 2020 versions up to and including 5.29.x
- PowerSYSTEM Center 2024 versions from 6.0.x through 6.2.x
- PowerSYSTEM Center 2026 versions from 7.0.x through 7.1.x

Subnet Solutions has issued mitigation guidance urging users to upgrade to the latest software updates. For PowerSYSTEM Center 2020 users, the recommendation is to update to Update 30. For PowerSYSTEM Center 2024 and 2026 users, the recommendation is to upgrade to Update 1.1. In cases where immediate upgrading is not feasible, the vendor recommends monitoring user activity records, disabling access to browser developer tools (F12) for Client Access Server users, and, for CVE-2026-63774 specifically, restricting access to the report designer.