Subnet Solutions PowerSYSTEM Center

CISA issued an advisory for Subnet Solutions PowerSYSTEM Center disclosing two critical vulnerabilities affecting multiple versions of the product. CVE-2026-63017 involves incorrect authorization allowing low-privileged authenticated users to access administrator-level resources. CVE-2026-63774 is an SQL injection vulnerability in the report designer enabling authenticated users to execute unauthorized SQL commands. Both vulnerabilities carry CVSS v3.1 scores of 9.0 (CRITICAL) and CVSS v4.0 scores of 9.4 (CRITICAL). Affected products include PowerSYSTEM Center 2020 (<=5.29.x), 2024 (6.0.x-6.2.x), and 2026 (7.0.x-7.1.x). The software is deployed worldwide in Critical Manufacturing and Energy sectors. Mitigations include upgrading to PowerSYSTEM Center 2026 Update 1.1, monitoring user activity, and disabling access to browser developer tools and the report designer. No known public exploitation has been reported, and the vulnerabilities are not exploitable remotely.