Subnet Solutions PowerSYSTEM Center

PowerSYSTEM Center versions affected include: 2020 $\le$5.29.x; 2024 $\ge$6.0.x|$\le$6.2.x; and 2026 $\ge$7.0.x|$\le$7.1.x.
Two vulnerabilities are detailed: CVE-2026-63017 (Incorrect Authorization) and CVE-2026-63774 (SQL Injection).
CVE-2026-63017 permits low-privileged, authenticated users to access restricted administrator resources.
CVE-2026-63774 allows an authenticated user to execute unauthorized SQL commands via the report designer.
Affected sectors include Critical Manufacturing and Energy; deployments are worldwide.
Mitigation for PowerSYSTEM Center 2024 involves upgrading to 2026 Update 1.1 or disabling access to the report designer if updating is impossible.
For PowerSYSTEM Center 2020, mitigation recommends an upgrade to Update 30.
CISA recommends minimizing network exposure and isolating control system networks behind firewalls.
Initial publication date of this advisory was 2026-11-03.

This information functions as a technical vulnerability advisory, designed not merely to inform but primarily to drive immediate defensive action within industrial control system environments. The narrative's core assumption is that the operational uptime and security of critical infrastructure hinge on timely application patching; deviation from this path exposes entities to quantifiable risk. The deployment across global Critical Infrastructure Sectors establishes an implicit pressure: rapid adoption of remediation measures is presented as a necessity for organizational survival, rather than just best practice.
The advisories structure presents a sophisticated layering of urgency—from the high-severity potential exploitation (SQL injection/unauthorized access) down to practical, albeit reactive, mitigations like disabling F12 tools or limiting report designer use. This sequence subtly shifts the burden from proactive engineering defense (secure by design) to reactive operational mitigation (hardening the perimeter around a faulty system). The vendor's extensive remediation guidance serves as an effective funnel, guiding users toward specific support channels and, implicitly, validating their existing product ecosystem.
Patterns detected: ARC-0127 Authority Game (Vendor framing vulnerability disclosure as required expertise for immediate compliance)
Root Cause: The tension between the need for high operational uptime in industrial settings and the inherent technical debt or design flaws present in complex control systems software. The unstated assumption is that patching schedules perfectly align with continuous operation mandates, which they rarely do in essential services.
Implications center on sovereignty—the ability of an organization to maintain autonomous control over its physical processes without external compromise. Those who fail to patch bear the cost of operational failure; those providing patches benefit from perceived security assurance.
What alternatives exist beyond patching or disabling features that might satisfy low-level access needs? How does the risk assessment change when mitigating controls themselves introduce new, unintended single points of failure? Under what justifiable circumstance would an organization need to maintain a vulnerable state longer than recommended for continuity of operations?