Plan ahead Critical Patch available CVSS up to 9.0
Subnet Solutions PowerSYSTEM Center has flaws allowing SQL commands and admin access
CISA ICS AdvisoriesSubnet Solutions · manufacturing, energyCVE-2026-63017, CVE-2026-63774
What happened. CISA lists two flaws in PowerSYSTEM Center: incorrect authorisation lets a low-privileged logged-in user reach administrator-only resources, and SQL injection could allow unauthorised database commands. The report gives a CVSS v3 score of 9.
Who is affected. Users of Subnet Solutions PowerSYSTEM Center 2020 (up to 5.29.x), 2024 (6.0.x to 6.2.x) and 2026 (7.0.x to 7.1.x), in Critical Manufacturing and Energy.
What to do. Check whether you run PowerSYSTEM Center 2020, 2024 or 2026 in the affected ranges, then apply the mitigation Subnet Solutions recommends in the advisory.
When to act. Plan ahead: CVSS 9.0
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: PowerSYSTEM Center is power-system management software with a database backend, which sits with site operations servers (L3) and supervisory systems (L2).
- Are you exposed?
Search the asset inventory for PowerSYSTEM Center 2020, 2024 or 2026 and compare each version against the affected ranges in the advisory.
- If you cannot fix it yet
- Restrict access to PowerSYSTEM Center to named users and known hosts, and remove unused low-privileged accounts.
- Keep the server behind an OT firewall, reachable only from approved engineering and operations hosts.
- Review which accounts hold administrator rights and tighten them.
- Watch for
- Unexpected SQL errors or unusual database queries in PowerSYSTEM Center application and database logs.
- Low-privileged accounts reaching administrator-only functions or resources.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA ICS Advisories (opens cisa.gov)
More on Manufacturing Energy and power CVE-2026-63017 CVE-2026-63774