CISA has alerted organizations to two severe security bugs in PowerSYSTEM Center that carry a CVSS score of 9.0. These issues could allow users with basic access to perform administrative actions or run unauthorized database commands, putting energy and manufacturing infrastructure around the world at risk. The vulnerabilities were disclosed in advisory ICSA-26-307-01 on November 3, 2026, and were reported by security experts Chinmay Patel of Digital Boundary Group and Subnet Solutions.
The Two Flaws Defined
The first issue, identified as CVE-2026-63017, is an authorization flaw (CWE-863). It allows users with minimal privileges to reach administrator-only resources, bypassing intended restrictions. Simply put, someone with a non-privileged account could access features or data they should not see.
The second problem, CVE-2026-63774, is a SQL injection vulnerability (CWE-89). Within the report-designer tool of PowerSYSTEM Center, insufficient safeguards exist for input validation. An authenticated user with report-design access could exploit this to issue unauthorized SQL commands. Although this allows database manipulation, there’s no evidence so far that it enables direct operating system compromise.
Affected Versions & What to Do
Both flaws share the following traits: low complexity of attack, low privileges required, no user interaction, and an adjacent network attack vector. Remote exploitation is not possible, and no exploitation in the wild had been reported at the time of the advisory’s release. PowerSYSTEM Center 2020 versions through 5.29.x, all 2024 releases 6.0.x-6.2.x, and 2026 versions 7.0.x-7.1.x are affected by CVE-2026-63017. The SQL injection issue impacts the 2024 and 2026 branches, but not the 2020 version line.
To fix the issues, those running the 2020 branch should apply Update 30. For both 2024 and 2026 branches, Update 1.1 is required. These patches are recommended as the primary defense.
Interim Safeguards & Best Practices
For organizations unable to immediately update, Subnet Solutions suggests limiting access to certain tools: restrict use of browser developer tools for Client Access Server users to contain the authorization bug. To mitigate SQL injection risks, access to the report designer should be limited only to absolutely necessary users. These are not substitutes for patching, but they reduce attack surface in the interim.
Broader network security practices must also be applied: ensure control systems are isolated from the internet, shielded with firewalls, and separated from business networks. When remote access is unavoidable, enforce updated VPNs and conduct strict device assessments. Per existing OT security guidance, exposure should be minimal and connectivity tightly controlled.
Before deploying patches or other changes, operators should evaluate how fixes might impact operations. Any signs of intrusion should trigger internal response protocols and reports to CISA. Alerting security teams equipped with threat intelligence support can help contain damage swiftly.
These flaws represent another reminder that even well-established industrial control platforms are not immune to high-severity security risks. Operators must balance operational continuity with timely patching and layered controls. What to watch now: whether threat actors begin exploiting these issues, how quickly organizations in impact sectors roll out the updates, and whether this leads to broader shifts in OT security posture.
