CVE-2026-63017

Overview

CVE-2026-63017 is a critical authorization flaw in PowerSYSTEM Center that permits low-privileged, authenticated users to access administrative resources. This vulnerability undermines the principle of least privilege and exposes sensitive system configurations to internal threats.

Description

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Impact

Confidentiality and integrity are compromised as unauthorized users can view or modify administrative data. Availability may be affected if malicious changes disrupt system operations. Internal users with basic access are the primary risk vector, posing a significant threat to organizations relying on this platform for critical infrastructure management.

Remediation

Apply the vendor-provided security patch immediately upon release. Restrict network access to PowerSYSTEM Center to trusted administrative subnets only. Enforce multi-factor authentication for all administrative accounts. Audit user roles and permissions to ensure no excessive privileges are assigned. Monitor logs for anomalous access patterns from low-privileged accounts.

Risk context

With a CVSS v3 score of 9.0 and CVSS v4 score of 9.4, this is a high-priority vulnerability requiring urgent attention. Although EPSS data is unavailable, the critical severity and ease of exploitation by authenticated users warrant immediate remediation to prevent potential compromise.

Affected products

• PowerSYSTEM Center