Subnet Solutions PowerSYSTEM Center: Critical Flaws and Fixes

Where things stand on 4 November 2026

CISA published ICSA-26-307-01 on 3 November 2026 for Subnet Solutions PowerSYSTEM Center, software used in energy and critical manufacturing environments. It describes two vulnerabilities: CVE-2026-63017 and CVE-2026-63774. Each is scored 9.0 (Critical) under CVSS v3.1 and 9.4 (Critical) under CVSS v4.0. CVSS measures how severe a flaw could be, not how likely anyone is to use it.

The vendor has released fixed updates, so the immediate action is to identify which edition and build you run and schedule the update. CISA states that no known public exploitation specifically targeting these vulnerabilities has been reported to it. That is a statement about what has been reported, not proof that nobody has tried.

This is an initial write-up. We have checked CISA's advisory but could not retrieve Subnet Solutions' own bulletin or the CVE.org and NVD records, so please read the CISA advisory and Subnet's release notes before you act on version numbers.

Which versions are affected

CISA lists three product lines. The two flaws do not hit all of them equally: the 2020 line is listed only against the authorisation flaw.

• PowerSYSTEM Center 2020, version 5.29.x and earlier: CVE-2026-63017.
• PowerSYSTEM Center 2024, versions 6.0.x through 6.2.x: CVE-2026-63017 and CVE-2026-63774.
• PowerSYSTEM Center 2026, versions 7.0.x through 7.1.x: CVE-2026-63017 and CVE-2026-63774.
• Fixed releases named by Subnet Solutions: PowerSYSTEM Center 2026 Update 1.1 (the target for both 2024 and 2026 users) and PowerSYSTEM Center 2020 Update 30 (for 2020 users).

What the flaws allow and how worried to be

CVE-2026-63017 is an incorrect authorisation flaw: a low-privileged but authenticated user can reach resources that should be limited to administrators. CVE-2026-63774 is an SQL injection flaw in the report designer, where insufficient input validation lets an authenticated user run SQL commands they should not be able to. In plain terms, someone who already has an ordinary account could do things only an administrator should be able to do, or read and alter data through the reporting feature. CISA's summary says successful exploitation could allow an attacker to execute unauthorised SQL commands and gain access to unauthorised resources.

The scores are high partly because the CVSS vector marks the impact on confidentiality, integrity and availability as high and the scope as changed. The attack vector is 'adjacent', meaning the attacker needs to be on the same local or otherwise logically adjacent network, and a login is required. CISA says the vulnerabilities are not exploitable remotely. Read that carefully: it does not make the risk small if you have many users, shared or weak credentials, contractors with access, or flat networks where a compromised office PC can reach the system.

Our judgement, not a vendor statement: the realistic worry is a stolen or misused ordinary account, or a curious insider, rather than an anonymous attacker on the internet. That makes account hygiene and network separation as important as the patch while you wait for a maintenance window.

What to do now

Updating industrial software is not a casual click-through. Treat it as a planned change with the people who run the plant or control room, because the system may need to be restarted or taken out of service. The steps below do not replace Subnet Solutions' own update instructions, which we have not been able to verify in detail.

1. Establish which edition and version you run. Ask your PowerSYSTEM Center administrator, or check with Subnet Solutions support if the version is unclear. Compare it to the ranges above, and note that 2020 builds up to 5.29.x are in scope.
2. Obtain the correct update from Subnet Solutions: 2026 Update 1.1 if you are on 2024 or 2026, or 2020 Update 30 if you are on 2020. Read its release notes for prerequisites, restart requirements and any database or backup steps they require. The CISA advisory lists Subnet's support contact details.
3. Book a maintenance window with operations staff, make a backup or snapshot in the way Subnet's documentation specifies, and trial the update on a non-production copy first if you have one. Moving a 2024 installation to 2026 Update 1.1 is a version upgrade, not a minor patch, so allow for compatibility testing.
4. Apply the update following the vendor's procedure. Expect some downtime; how long depends on your database size and environment, and we have no vendor timing to quote.
5. Confirm the result: the installed version should now be the fixed update, and users should be able to sign in and operations should be normal. Record the change in your change log.

If you cannot update yet

Subnet Solutions gives limited stop-gap measures. None of them removes the vulnerability, so keep a date for the update.

For CVE-2026-63774 on 2024 and 2026, disable user access to the report designer. The cost is that nobody can build or edit reports until you update, so check who relies on it. For 2020, CISA lists that product only against CVE-2026-63017, so there is no report designer mitigation to apply.

For CVE-2026-63017 on all versions, Subnet recommends monitoring user activity records for acceptable use and disabling Client Access Server users' access to the browser's F12 Developer Tools. The advisory does not say how to do that, so ask Subnet support rather than guessing. In our view that is a speed bump rather than a barrier, so do not rely on it alone.

Alongside the vendor's measures, CISA's general advice for control system devices applies: keep them off the internet, put them behind firewalls isolated from business networks, and use an updated VPN for remote access. Reviewing who actually has accounts, removing unused ones and ending shared logins is sensible and costs little.

After the update

Patching closes the hole; it does not tell you whether it was used beforehand. Because the first flaw involves ordinary users reaching administrator functions, look back through user activity records for unusual administrative actions, unexpected report designer use or accounts acting outside their role. If something looks wrong, treat it as a possible security incident under your own procedures and involve Subnet Solutions.

Exploitation and real-world impact

As of 4 November 2026, CISA's advisory says no known public exploitation specifically targeting these vulnerabilities has been reported to it. We have not located any public report naming affected organisations, and we will not speculate about any. A separate earlier CISA advisory for the same product line, ICSA-26-132-02 from May 2026, covers different CVEs and fixed updates; do not confuse the two when checking your patch level.