Subnet Solutions PowerSYSTEM Center Flaws Let Low-Privilege Users Run SQL

Key points

• CVE-2026-63017 and CVE-2026-63774 affect Subnet Solutions PowerSYSTEM Center.
• Exploitation requires a valid account with only basic privileges.
• Impact includes SQL statement execution and access to off-limits resources.
• Affected releases span the 2020, 2024, and 2026 product lines.
• Energy and critical manufacturing users worldwide should review exposure.

Subnet Solutions has disclosed two security defects in PowerSYSTEM Center, tracked as CVE-2026-63017 and CVE-2026-63774. The issues involve SQL injection and authorization checks that are not correctly enforced. An attacker who already holds a low-privilege authenticated account could abuse the flaws to issue SQL statements without approval and to reach resources that should be off-limits. This is not a pre-authentication attack, so broad exposure is limited, but compromised or insider accounts remain a meaningful risk.

Affected releases include the 2020 family at 5.29.x, 2024 editions numbered 6.0.x through 6.2.x, and 2026 editions from 7.0.x to 7.1.x. Subnet Solutions customers in energy and critical manufacturing are the primary audience, and deployments exist across the world. Because these platforms support operational technology environments, a medium-rated flaw can still matter when an authenticated user crosses data boundaries.

The combination of SQL injection and improperly applied authorization can expose configuration, operational data, or account details. Low-privilege users are often trusted inside OT networks, and patching cycles in industrial environments can be slow. That makes detection and access control important while fixes are staged. Organizations should treat unexpected database activity from application accounts as suspicious, especially when it comes from accounts that normally perform only routine tasks.

Watch for the vendor advisory and updated builds for each affected branch. Review logs for unusual SQL statements, failed authorization events, and access to restricted resources. Confirm whether any low-privilege accounts have recently changed behavior or been used from new locations. If a patch is not yet available, reduce exposure by limiting interactive access and tightening database permissions until the affected systems can be updated.

What to do now

1. Inventory every PowerSYSTEM Center instance and map its version against 5.29.x, 6.0.x-6.2.x, and 7.0.x-7.1.x; apply vendor updates or mitigations as soon as they are available.
2. Restrict access to trusted administrative networks and require strong authentication for all accounts, especially low-privilege users.
3. Review database service accounts and remove unnecessary write, schema-change, and cross-database permissions.
4. Enable and monitor logs for anomalous SQL statements, failed authorization checks, and access to restricted resources.
5. Audit low-privilege accounts, disable stale or shared credentials, and investigate recent changes in account behavior.
6. Segment PowerSYSTEM Center from general IT networks and limit outbound database connections to approved endpoints.
7. After patching, validate authorization controls and rerun access reviews to confirm that restricted resources remain protected.

CVE references

• CVE-2026-63017
• CVE-2026-63774

Original source

CISA Advisories