CISA also recommends users take the following measures to protect themselves from social engineering attacks:
Do not click web links or open attachments in unsolicited email messages.
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.
Credit: Chinmay Patel (Digital Boundary Group); Subnet Solutions
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2026-63017 | CWE-863 Incorrect Authorization | 9.0 Critical |
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators. CISA SSVC — Exploitation: None · Automatable: No · Impact: Total Mitigation: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team… Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If unab… Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If una… Affected, fixed & timelineAffected:
|
| CVE-2026-63774 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 9.0 Critical |
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands. CISA SSVC — Exploitation: None · Automatable: No · Impact: Total Mitigation: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team… Mitigation: Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. If una… Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2026-63017 | 9.0 Critical | Subnet Solutions PowerSYSTEM Center 2020 Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators. |
| CVE-2026-63774 | 9.0 Critical | Subnet Solutions PowerSYSTEM Center 2024 Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands. |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.