What Happened

CISA published industrial control systems advisory ICSA-26-307-01 on November 3, 2026, warning operators of two serious vulnerabilities in Subnet Solutions' PowerSYSTEM Center application. The weaknesses involve improper access controls and the ability of an authenticated user to issue unauthorised SQL commands through the report designer. CISA describes potential consequences as access to restricted resources and manipulation of database queries, which are serious risks for organizations that depend on the application within industrial operations.

The combined advisory lists a CVSS v3.1 base score of 9.0, categorized as critical. Yet it also makes two limiting statements that deserve equal attention: the vulnerabilities are not exploitable remotely, and CISA had received no reports of known public exploitation specifically targeting them at publication. This is a vulnerability disclosure and patching story, not evidence of an ongoing grid attack, industrial outage or confirmed breach.

The Two Vulnerabilities

CVE-2026-63017 is an incorrect-authorization issue. The advisory says a low-privileged, authenticated PowerSYSTEM Center user could reach resources that should be reserved for administrators. In practice, access-control failures are concerning because permissions that appear limited in the user interface may not be consistently enforced on the server side. An organization must not assume a standard user account automatically lacks access to sensitive functions.

CVE-2026-63774 concerns insufficient validation of inputs to the PowerSYSTEM Center report designer. CISA says an authenticated user could issue unauthorised SQL statements. SQL injection can undermine the integrity of application data and expose information, depending on the database privileges of the application account and the system's configuration. The advisory does not establish that an external unauthenticated attacker can simply connect over the internet and exploit the flaw.

Both vulnerabilities are scored 9.0 under CVSS v3.1 in the CISA advisory, with CVSS v4.0 scores also presented. The scores communicate potential technical impact under the defined attack conditions, not the probability of a particular industrial site being attacked today.

Exactly Which Versions Are Affected

The affected product matrix is not identical for the two CVEs. PowerSYSTEM Center 2020 through version 5.29.x is listed for the incorrect-authorization issue, CVE-2026-63017, but is not listed as affected by the report-designer SQL injection issue. PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x and PowerSYSTEM Center 2026 versions 7.0.x through 7.1.x are listed for both vulnerabilities.

That distinction matters to readers who manage a mixed estate. A single line claiming that both CVEs affect every release in the 2020, 2024 and 2026 families would be wrong. Product owners should compare each deployed instance to the individual affected-version range before deciding which fixes or workarounds are relevant.

Patches And Vendor Recommendations

For the 2020 product line, Subnet Solutions recommends PowerSYSTEM Center 2020 Update 30 as the fix for the authorization vulnerability. For affected 2024 versions, the vendor recommends upgrading to PowerSYSTEM Center 2026 Update 1.1. Affected 2026 installations should also be updated to PowerSYSTEM Center 2026 Update 1.1. These are vendor-recommended targets documented in the November 3 CISA advisory, not independent guarantees about support or compatibility for every deployment.

For users who cannot immediately upgrade, the published mitigation advice includes monitoring user activity records. For the authorization weakness, Subnet Solutions recommends disabling Client Access Server users' access to the browser's F12 Developer Tools as an interim measure. For the SQL injection issue, disabling access to the report designer is specifically recommended when upgrading is not possible.

Disabling browser developer tools should not be described as a substitute for a server-side authorization fix. Organizations should treat such restrictions as vendor-described temporary risk reduction and prioritize supported updates, access review and application-side control validation. Changes to critical systems should go through operational testing and change-control procedures.

Why An Industrial Application Deserves Attention

CISA identifies Critical Manufacturing and Energy as sectors associated with this product and says the equipment is deployed worldwide. Power-system engineering and industrial-management tools may be connected to wider operational environments, where compromised permissions or database integrity could disrupt the trustworthiness of information and workflows. The advisory's potential impact does not, however, establish that generation equipment, safety controllers or physical grid operations can be directly manipulated through these vulnerabilities.

A low-privileged authenticated user can be an insider, an inadvertently overprivileged account or an account controlled by an attacker after a separate compromise. In other words, the lack of a direct remote exploitation path does not eliminate all risk. It narrows the necessary conditions and should guide account monitoring, privilege reviews and network segmentation.

CISA recommends minimizing internet exposure of control systems, separating operational networks from business networks with firewalls and maintaining secure remote access. These defense-in-depth practices are relevant to industrial security more broadly but should not be confused with proof that this specific flaw is internet-exploitable.

Action Checklist For Operators

Operators should identify deployed PowerSYSTEM Center versions and relevant instances, including engineering environments that may not appear in routine enterprise software inventories. Confirm which accounts can use report-design and administrative features, review unusual access in available application logs, and prioritize updating affected systems with support from the vendor and operations owners.

Where a maintenance window is needed, prepare a tested backup and rollback plan, verify dependencies, and document temporary limits on report designer access and user privileges. Organizations with vendors or system integrators maintaining the product should confirm who owns patch execution and how successful installation will be demonstrated.

What Is Known And Unknown

The advisory was published November 3, 2026 and attributes vulnerability reporting to Chinmay Patel of Digital Boundary Group and Subnet Solutions. The primary technical evidence available publicly is the CISA industrial advisory and its structured CSAF/CVE record, alongside official release notice. Independent reports repeating the advisory do not constitute independent confirmation of an incident or a known victim.

As of the advisory's publication, CISA explicitly stated that no known public exploitation had been reported and that these vulnerabilities were not remotely exploitable. CyberGeek News therefore treats this as a high-severity preventive security bulletin, not as coverage of an observed cyberattack.