CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
Executive Summary
Executive Summary In November 2026, CISA published ICS Advisory ICSA-26-307-01 disclosing two critical vulnerabilities (CVE-2026-63017 and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center, an industrial control system platform widely deployed in critical manufacturing and energy sectors worldwide. CVE-2026-63017, rated CVSS 9.4, allows a low-privileged authenticated user to access administrator-restricted resources via incorrect authorization (CWE-863). CVE-2026-63774, also rated CVSS 9.4, enables authenticated users to execute unauthorized SQL commands through the report designer due to insufficient input validation (CWE-89). Both vulnerabilities require adjacent network access and affect versions spanning the 2020, 2024, and 2026 product lines. Successful exploitation could expose sensitive operational data, manipulate ICS database records, and disrupt energy grid management functions.
These vulnerabilities are significant because they target ICS/OT environments in energy and critical manufacturing—sectors already under elevated threat from nation-state and ransomware actors. The combination of privilege escalation and SQL injection within a single OT platform dramatically lowers the bar for insider threats and lateral movement, reflecting a broader trend of attackers targeting operational technology management layers rather than field devices alone.
Why This Matters Now
Why This Matters NowICS and OT environments are experiencing a surge in targeted attacks from nation-state actors and ransomware groups specifically seeking to disrupt energy infrastructure. With CVSS scores of 9.4 and no authentication bypass required—only low-privilege credentials—these flaws are highly exploitable in environments where lateral movement within OT network segments is often unmonitored, making immediate patching and network segmentation critical.
Attack Path Analysis
Attack Path AnalysisAn authenticated low-privileged user on an adjacent network exploits CVE-2026-63017 (Incorrect Authorization) in Subnet Solutions PowerSYSTEM Center to access administrator-restricted resources, then leverages CVE-2026-63774 (SQL Injection via the report designer) to escalate privileges and execute unauthorized database commands against critical energy/manufacturing ICS data. From there, the attacker pivots laterally within the OT network, establishes persistence and command channels, exfiltrates sensitive operational data, and ultimately threatens availability and integrity of industrial control systems.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAn attacker with low-privileged, authenticated access on an adjacent network (AV:A per CVSS vector) exploits CVE-2026-63017, an Incorrect Authorization flaw (CWE-863), to gain access to resources normally restricted to administrators within PowerSYSTEM Center. No external internet access is required; the attacker only needs network adjacency and a valid low-privilege account, consistent with insider threat or a previously compromised endpoint on the OT/IT boundary.
Related CVEs
Related CVEsCVE-2026-63017
CVSS 9Incorrect authorization in Subnet Solutions PowerSYSTEM Center allows a low-privileged authenticated user to access resources normally restricted to administrators, potentially leading to full system compromise across critical infrastructure environments.
Affected Products:
Subnet Solutions PowerSYSTEM Center 2020 – <= 5.29.x
Subnet Solutions PowerSYSTEM Center 2024 – >= 6.0.x, <= 6.2.x
Subnet Solutions PowerSYSTEM Center 2026 – >= 7.0.x, <= 7.1.x
Exploit Status:
no public exploitCVE-2026-63774
CVSS 9Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands, enabling potential data exfiltration, data manipulation, and unauthorized access to the underlying database in critical infrastructure deployments.
Affected Products:
Subnet Solutions PowerSYSTEM Center 2024 – >= 6.0.x, <= 6.2.x
Subnet Solutions PowerSYSTEM Center 2026 – >= 7.0.x, <= 7.1.x
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesValid Accounts
Exploit Public-Facing Application
Abuse Elevation Control Mechanism
Access Token Manipulation
Drive-by Compromise
Command and Scripting Interpreter
Data Manipulation
Manipulation of Control
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Least Privilege
Control ID: AC-6
NIST SP 800-53 Rev. 5 – Information Input Validation
Control ID: SI-10
CISA Zero Trust Maturity Model 2.0 – Continuous Authorization and Access Control
Control ID: Identity Pillar - Authorization
NIS2 Directive – Supply Chain and Software Security
Control ID: Article 21(2)(d)
IEC 62443-3-3 – Authorization Enforcement
Control ID: SR 2.1
DORA (Digital Operational Resilience Act) – ICT Security - Protection and Prevention
Control ID: Article 9
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Oil/Energy/Solar/Greentech
PowerSYSTEM Center ICS/OT SQL injection and incorrect authorization vulnerabilities (CVSS 9.4) directly threaten energy grid management systems, enabling unauthorized access to critical operational data and controls.
Utilities
Critical ICS vulnerabilities in PowerSYSTEM Center expose utility operators to privilege escalation and lateral movement risks, with zero trust segmentation and egress controls urgently needed to contain potential operational disruption.
Industrial Automation
SQL injection flaws in PowerSYSTEM Center report designer allow authenticated users to execute unauthorized commands, threatening industrial automation environments reliant on SCADA integrity and NIST.800-53.SC-7 network boundary controls.
Government Administration
Worldwide deployment of vulnerable PowerSYSTEM Center across critical manufacturing and energy infrastructure implicates government-administered facilities, requiring immediate ICS network isolation and CISA-recommended defense-in-depth segmentation strategies.
Sources
Sources- Subnet Solutions PowerSYSTEM Centerhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01Verified
- CISA ICS Advisories Landing Pagehttps://www.cisa.gov/news-events/ics-advisoriesVerified
- Subnet Solutions Official Support and Product Informationhttps://www.subnet.comVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- CISA ICS Security Recommended Practiceshttps://www.cisa.gov/icsVerified
- NVD National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's entire chain depends on unrestricted network adjacency and flat east-west reachability within an OT environment. By enforcing identity-aware segmentation and controlled egress across the ICS network boundary, Aviatrix would likely reduce the attacker's ability to move freely from the compromised PowerSYSTEM Center tier toward downstream SCADA and HMI assets.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Strict network segmentation enforced at the OT boundary would likely reduce the reachable surface available to an adjacent low-privilege account, constraining which workloads and application tiers that account could initiate connections toward, even before any authorization logic within PowerSYSTEM Center is evaluated.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the database-tier reachability available to the compromised application session, reducing the scope of data stores and permission tables that an elevated SQL session could interact with from a single compromised workload identity.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to pivot from the compromised PowerSYSTEM Center server toward downstream SCADA and HMI workloads, constraining lateral reachability even after the initial application tier is compromised.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the OT network fabric would likely surface anomalous command patterns and unusual inter-workload communication volumes emanating from the compromised application tier, reducing the window during which rogue SQL-driven automation or unauthorized application commands could operate without detection.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement would likely constrain the outbound paths available from the OT network segment, reducing the attacker's ability to route extracted operational data to arbitrary external destinations without traversing an enforced egress boundary.
If prior CNSF controls have constrained lateral reachability, east-west paths, and egress channels, the attacker's ability to interact with downstream SCADA and HMI assets would likely be reduced in scope, limiting the range of ICS devices and operational data stores exposed to manipulation or disruption even after the PowerSYSTEM Center application tier is fully compromised.
Impact at a Glance
Affected Business Functions
- Energy Grid Monitoring and SCADA Operations
- Critical Manufacturing Process Control
- ICS/OT Administrative Access and Authorization Management
- Operational Reporting and Data Analytics
Estimated downtime: 3 days
Estimated loss: N/A
Exploitation of CVE-2026-63017 could allow low-privileged users to access administrator-level resources, exposing sensitive operational technology data including grid topology configurations, system access credentials, user management records, and proprietary energy system operational parameters. Exploitation of CVE-2026-63774 via SQL injection in the report designer could expose underlying database contents including historical operational data, event logs, user account information, and configuration tables. In critical infrastructure sectors such as energy and critical manufacturing, such exposure could also indirectly reveal physical system operational states and control parameters. No confirmed data breach or financial loss has been reported at this time.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation immediately: Deploy identity-based microsegmentation (aligned with ZTMM.Network, NIST.800-53.AC-6) to enforce least-privilege network access between PowerSYSTEM Center tiers and downstream ICS/SCADA assets, preventing lateral movement even if an authenticated user account is compromised.
- • Enforce East-West Traffic Security for OT environments: Implement workload-to-workload traffic controls (ZTMM.Network, NIST.800-53.SC-7) to inspect and restrict internal flows between the PowerSYSTEM Center application server, its database, and connected control system components, limiting the blast radius of SQL injection exploitation.
- • Deploy Egress Security and Policy Enforcement: Establish FQDN-based egress filtering and outbound traffic controls (ZTMM.Data, NIST.800-53.SC-18, NIST.CSF.PR.DS-5) on OT network segments to detect and block unauthorized data exfiltration attempts originating from the compromised ICS management platform.
- • Enable Multicloud Visibility and Anomaly Detection: Instrument centralized traffic observability and anomaly alerting (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) across the ICS network to identify repeated malformed SQL requests, anomalous report designer activity, and unauthorized administrative resource access indicative of CVE-2026-63017 and CVE-2026-63774 exploitation.
- • Encrypt All Data in Transit with High-Performance Encryption: Apply MACsec or IPsec encryption to all traffic traversing OT/IT boundary segments (ZTMM.Data, NIST.CSF.PR.DS-2, NIST.800-53.SC-12) to prevent packet sniffing of unencrypted operational data during exfiltration and to reduce the value of intercepted lateral movement traffic within the ICS environment.
