CISA has published advisory ICSA-26-307-01 warning of two critical vulnerabilities in Subnet Solutions’ PowerSYSTEM Center, software that helps power plants and utilities manage grid equipment worldwide. Each flaw is scored 9.4 on the CVSS v4 scale, though CISA says neither is exploitable remotely and no public exploitation has been reported.
Two Flaws Scored 9.4 in PowerSYSTEM Center
The affected products are PowerSYSTEM Center 2020 up to 5.29.x, the 2024 line from 6.0.x to 6.2.x, and 2026 builds.
CVE-2026-63017 Exposes Admin Data and Root Files
CVE-2026-63017 is an incorrect authorization flaw, classed as CWE-863. A low-privileged user on an adjacent network can view administrator data and open files intended for root.
CVE-2026-63774 Allows SQL Injection in the Report Tool
CVE-2026-63774 is a SQL injection flaw, classed as CWE-89, in the report tool. A logged-in user can run arbitrary database queries and change stored data.
Why CISA Says the PowerSYSTEM Center Flaws Are Not Remotely Exploitable
CISA says neither flaw is exploitable remotely. The first requires a position on an adjacent network, and the second requires a logged-in account. No public exploitation has been reported.
Digital Boundary Group’s Chinmay Patel Found the Flaws
Chinmay Patel of Digital Boundary Group and the vendor found the flaws. The product’s role in energy operations is the main reason the advisory drew coverage, since utilities use it to manage grid equipment.
PowerSYSTEM Center Update 30 and 2026 Update 1.1 Fixes
Subnet Solutions released Update 30 for older builds. For newer ones, the fixes are PowerSYSTEM Center 2026 Update 1.1 and Update 1.1. The second CVE, the SQL injection, is fixed only in the 2026 Update 1.1 and Update 1.1 releases.
CISA’s Defensive Guidance for PowerSYSTEM Center
The advisory response includes CISA’s standard defensive guidance for industrial control systems, along with the vendor updates. The coverage does not list further measures specific to these flaws.
Potential Impact of the Flaws on Energy Operators
The impact described is limited to insiders or attackers already on an adjacent network, who could read sensitive data or tamper with records in energy-sector systems. The advisory does not describe any effect on the physical operation of grid equipment.
The advisory appeared on Nov. 5 and 6. CVSS v4 scores of 9.4 place both flaws in the critical band, yet the access prerequisites, adjacent network placement for one and a logged-in user for the other, are what CISA cites in saying remote exploitation is not possible.
The incorrect authorization flaw is notable for what it exposes: administrator data and files meant for root, which could include configuration and credentials held by the software. The SQL injection is notable for its write capability, since changing stored data in a utility’s management database could alter records that operators rely on.
Because the second CVE is fixed only in the newest releases, operators on older builds who apply Update 30 receive the fix for the first flaw but not the second. The coverage presents this as a difference in what each update covers and does not elaborate further on the reason.
Energy Sector Context for Advisory ICSA-26-307-01
PowerSYSTEM Center helps power plants and utilities manage grid equipment around the world, so the advisory reaches operators in multiple countries. CISA published advisory ICSA-26-307-01 on Nov. 5 and 6, and SecurityOnline summarized it. The vendor and Chinmay Patel of Digital Boundary Group are credited with finding the two flaws, and CISA says no public exploitation has been reported.
Affected Versions Named in the Advisory
The advisory lists PowerSYSTEM Center 2020 through version 5.29.x, the 2024 line from 6.0.x to 6.2.x and the 2026 builds. Update 30 covers older builds, and 2026 Update 1.1 and Update 1.1 cover newer ones. Each of the two CVEs carries a CVSS v4 score of 9.4, and no public exploitation has been reported.
