The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding two critical vulnerabilities in PowerSYSTEM Center, which could significantly impact the energy and manufacturing sectors worldwide. These flaws, rated with a Common Vulnerability Scoring System (CVSS) score of 9.0, could allow authenticated users to gain unauthorized access to administrative resources or execute unauthorized database commands.
Details of the Vulnerabilities
CISA’s advisory, ICSA-26-307-01, released on November 3, 2026, credits Chinmay Patel from Digital Boundary Group and Subnet Solutions for identifying these risks. The Canadian vendor has provided guidance for system updates and temporary solutions for those unable to upgrade immediately.
The first flaw, identified as CVE-2026-63017, involves an improper authorization process, classified under CWE-863. This issue permits users with restricted permissions to access administrator-level resources, bypassing intended access controls.
SQL Injection Threat
The second vulnerability, CVE-2026-63774, is an SQL injection issue, categorized under CWE-89. It arises from inadequate input validation in the report designer, allowing users to execute unauthorized SQL commands. Although this flaw impacts database operations, it does not extend to operating system-level code execution.
Both vulnerabilities are characterized by low attack complexity and require minimal privileges, with no need for user interaction. They utilize an adjacent attack vector, not requiring direct network access, and are not remotely exploitable at this time.
Mitigation and Recommendations
CVE-2026-63017 affects various versions of PowerSYSTEM Center, including the 2020, 2024, and 2026 series. Meanwhile, CVE-2026-63774 affects the 2024 and 2026 versions. Subnet Solutions advises updating to the latest versions, such as PowerSYSTEM Center 2020 Update 30 or PowerSYSTEM Center 2026 Update 1.1, to mitigate these risks.
For organizations unable to update immediately, monitoring user activities and restricting access to certain developer tools can help reduce the risk of unauthorized access. Additionally, limiting user access to the report designer can help manage the SQL injection threat.
Further protective measures include keeping control systems off public networks, employing firewalls, and segregating them from business networks. Where remote access is necessary, using updated VPNs and assessing connected devices is crucial. Before implementing changes, operators should evaluate their impact and follow internal security protocols for any suspicious activities.
