SecOraLens
CriticalCVE

CISA Warns Two Critical 9.0 Flaws in PowerSYSTEM Center Allow Unauthorized Access and SQL Injection

Cyber Security News·Source published ·1 min read

What happened?

CISA warned that two critical PowerSYSTEM Center flaws (CVSS 9.0) could let authenticated users access administrator resources or execute unauthorized database commands, affecting energy and manufacturing sectors worldwide. The agency released advisory ICSA-26-307-01 on November 3, 2026. CISA credited Chinmay Patel of Digital Boundary Group and Subnet Solutions with reporting the vulnerabilities. The Canadian vendor has provided upgrade guidance and temporary measures for organizations that cannot immediately update affected systems.

Key details

  • CISA released advisory ICSA-26-307-01 on November 3, 2026, warning of two critical PowerSYSTEM Center flaws with CVSS 9.0 scores.
  • Both vulnerabilities have low attack complexity, low privileges required, no user interaction, and adjacent attack vector.
  • CISA states the vulnerabilities are not remotely exploitable and no public exploitation was reported at advisory release.
  • CVE-2026-63017 affects PowerSYSTEM Center 2020 through 5.29.x, 2024 versions 6.0.x-6.2.x, and 2026 versions 7.0.x-7.1.x.
  • CVE-2026-63774 affects PowerSYSTEM Center 2024 versions 6.0.x-6.2.x and 2026 versions 7.0.x-7.1.x, but not the 2020 branch.

Affected

  • PowerSYSTEM Center 2020 versions through 5.29.x affected by CVE-2026-63017.
  • PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x affected by both CVE-2026-63017 and CVE-2026-63774.
  • PowerSYSTEM Center 2026 versions 7.0.x through 7.1.x affected by both CVE-2026-63017 and CVE-2026-63774.

Fixes and mitigations

  1. Upgrade PowerSYSTEM Center 2024 branch to PowerSYSTEM Center 2026 Update 1.1.
  2. Update existing PowerSYSTEM Center 2026 installations to Update 1.1.
  3. Monitor user activity records and restrict Client Access Server users' access to browser F12 Developer Tools as interim measure for authorization flaw.
  4. Restrict user access to the report designer as interim measure for SQL injection flaw.
  5. Keep control systems off public internet, behind firewalls, and separated from business networks.
  6. Use updated VPNs and assess connected devices for necessary remote access.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories