CISA ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center has a critical authorization bypass (CVE-2026-63017) and a report-designer SQL injection (CVE-2026-63774)
- Fixes (per Subnet via CISA): 2020 → Update 30; 2024 → upgrade to PowerSYSTEM Center 2026 Update 1.1; 2026 → Update 1.1. Contact Subnet support for upgrade help.
- If you cannot patch yet: monitor user-activity records against acceptable-use policy, and disable Client Access Server users' ability to open the browser F12 developer tools (Subnet's interim guidance).
- Exposure model: both bugs need an authenticated session on an adjacent/network path to the app — still urgent anywhere PowerSYSTEM Center sits on a shared OT/IT jump network.
Sources: CISA ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center (Nov 3)