CISA warns of critical flaws in Subnet Solutions software

CISA warns of two critical vulnerabilities in Subnet Solutions PowerSYSTEM Center, tracked as CVE-2026-63017 (PowerSYSTEM Center Incorrect Authorization) and CVE-2026-63774 (PowerSYSTEM Center SQL Injection). Both have a CVSSv4 score of 9.4. The advisory notes that a low-privileged, authenticated user could bypass access controls to view admin data and, in the case of CVE-2026-63774, run rogue database queries to alter stored data.

Subnet Solutions has issued fixes in PowerSYSTEM Center 2026 Update 1.1 and Update 1.1, as well as Update 30 for 2020 builds. The vendor recommends contacting support to obtain the updates, or, if patching is not possible, disabling access to the report tool and restricting access on the Client Access Server. CISA also advises keeping control networks behind firewalls. No known public exploitation had been reported to CISA at the time of the advisory.

Affected versions extend from PowerSYSTEM Center 2020 builds up to 5.29.x, PowerSYSTEM Center 2024 versions 6.0.x to 6.2.x, and PowerSYSTEM Center 2026 builds 7.0.x to 7.1.x. The flaws were identified by Chinmay Patel of Digital Boundary Group alongside the vendor team. CISA’s ICS advisory ICSA-26-307-01 states that these vulnerabilities are not exploitable remotely, and to date there was no confirmed exploitation. The article notes the two CVEs and the accompanying mitigation, emphasising patching as the primary defensive measure.