Subnet Solutions PowerSYSTEM Center SQL Injection Vulnerabilities (CVE‑2026‑63017, CVE‑2026‑63774) – Immediate Upgrade Required

What happened

In early 2026, Subnet Solutions disclosed that multiple versions of its PowerSYSTEM Center platform contain critical flaws that can be exploited to run arbitrary SQL commands and bypass authorization controls. The vulnerabilities, identified as CVE‑2026‑63017 and CVE‑2026‑63774, allow a low‑privileged, authenticated user to access data and functions normally reserved for administrators.

Both issues stem from improper neutralization of special characters in SQL statements and a missing authorization check on certain API endpoints. Attackers can inject malicious SQL through the web interface or API calls, leading to data exfiltration, modification, or even full system compromise.

Who is affected

All installations of PowerSYSTEM Center that fall within the affected version ranges are at risk. Specifically:

• PowerSYSTEM Center 2020 ≤ 5.29.x (CVE‑2026‑63017)
• PowerSYSTEM Center 2024 ≥ 6.0.x ≤ 6.2.x (CVE‑2026‑63017, CVE‑2026‑63774)
• PowerSYSTEM Center 2026 ≥ 7.0.x ≤ 7.1.x (CVE‑2026‑63017, CVE‑2026‑63774)

Organizations that rely on PowerSYSTEM Center for critical manufacturing or energy operations worldwide are particularly vulnerable, as the platform is used to monitor and control industrial processes.

Impact

The combined effect of the two vulnerabilities is a high‑severity risk. The CVSS v3 score is 9.0, reflecting the potential for complete data loss, unauthorized configuration changes, and service disruption. In a manufacturing plant, an attacker could alter process parameters, leading to equipment damage or safety incidents.

Because the flaws can be triggered by authenticated users, insider threats or compromised user credentials become a serious concern. Even a single low‑privileged account with access to the web console can become a foothold for lateral movement within the network.

Exposure

Exploitation requires the attacker to first authenticate to the PowerSYSTEM Center web portal or API. Once authenticated, the attacker can send specially crafted requests that bypass the missing authorization check. The platform’s default configuration often exposes the API to external networks, increasing the attack surface.

Once the SQL injection is successful, the attacker can read, modify, or delete database records. In the worst case, they can execute arbitrary SQL that affects the underlying PostgreSQL or Oracle database, potentially granting full control over the entire system.

What to do

Defenders should immediately assess whether their environment runs any of the affected versions. If so, the following actions are mandatory:

• Upgrade to the latest supported release (PowerSYSTEM Center 2026 Update 1.1 or newer). Contact Subnet Solutions’ System Integration team or [email protected] for assistance.
• If an upgrade is not possible, disable the ability of PowerSYSTEM Center Client Access Server users to open browser developer tools (F12) to limit the ability to discover injection points.
• Implement strict role‑based access controls and ensure that only administrators have permission to execute privileged API calls.
• Enable logging of all SQL queries and monitor for anomalous activity patterns, such as repeated failed authentication attempts or unusual query lengths.
• Apply network segmentation so that the PowerSYSTEM Center database is isolated from other critical assets and only reachable via secure, monitored channels.

Additionally, conduct a thorough review of user accounts, removing any that are no longer needed and enforcing multi‑factor authentication for all privileged users.

What to watch

Security teams should keep an eye on the following indicators:

• Unexpected database errors or timeouts that could signal injection attempts.
• Unauthorized changes to process parameters or configuration files.
• Newly created database users or roles that do not match documented personnel.
• External traffic targeting the PowerSYSTEM Center API endpoints, especially from untrusted IP ranges.

Finally, stay informed about any additional advisories from Subnet Solutions or the CISA CSAR database, as new mitigations or workarounds may be released.