---
title: CISA ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center has a critical authorization bypass (CVE-2026-63017) and a report-designer SQL injection (CVE-2026-63774) | ctxsec
url: https://ctxsec.com/items/cisa-icsa-26-307-01-subnet-powersystem-center-authz-sqli
description: "CISA's Nov 3 ICS advisory covers Subnet Solutions PowerSYSTEM Center, used in critical manufacturing and energy. CVE-2026-63017 (CVSS 3.1 9.0) lets a low-privileged authenticated user reach administrator resources. CVE-2026-63774 is insufficient input validation in the report designer that lets an authenticated user run unauthorized SQL. Affected lines: PowerSYSTEM Center 2020 \u22645.29.x (63017); 2024 6.0.x\u20136.2.x and 2026 7.0.x\u20137.1.x (both CVEs)."
status: "official (CISA ICSA-26-307-01, Nov 3); no exploitation reported in the advisory"
published: 2026-11-03
---

> CISA's Nov 3 ICS advisory covers Subnet Solutions PowerSYSTEM Center, used in critical manufacturing and energy. CVE-2026-63017 (CVSS 3.1 9.0) lets a low-privileged authenticated user reach administrator resources. CVE-2026-63774 is insufficient input validation in the report designer that lets an authenticated user run unauthorized SQL. Affected lines: PowerSYSTEM Center 2020 ≤5.29.x (63017); 2024 6.0.x–6.2.x and 2026 7.0.x–7.1.x (both CVEs).

[← Cybersecurity News](/news) · [markdown](/items/cisa-icsa-26-307-01-subnet-powersystem-center-authz-sqli.md)

official (CISA ICSA-26-307-01, Nov 3); no exploitation reported in the advisory

2026-11-03

### CISA ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center has a critical authorization bypass (CVE-2026-63017) and a report-designer SQL injection (CVE-2026-63774)

- **Fixes (per Subnet via CISA):** 2020 → Update 30; 2024 → upgrade to PowerSYSTEM Center 2026 Update 1.1; 2026 → Update 1.1. Contact Subnet support for upgrade help.
- **If you cannot patch yet:** monitor user-activity records against acceptable-use policy, and disable Client Access Server users' ability to open the browser F12 developer tools (Subnet's interim guidance).
- **Exposure model:** both bugs need an authenticated session on an adjacent/network path to the app — still urgent anywhere PowerSYSTEM Center sits on a shared OT/IT jump network.

Sources: [CISA ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center (Nov 3)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01)