CISA Discloses Two Critical Flaws in Subnet Solutions PowerSYSTEM Center

On November 3, 2026, CISA published ICSA-26-307-01, disclosing two vulnerabilities in Subnet Solutions' PowerSYSTEM Center, a SCADA/EMS data-management platform used by electric utilities to aggregate substation and grid telemetry into dashboards and reports. The independent trade outlet ISSSource corroborated the disclosure the same day, confirming the affected versions and the vendor's remediation guidance. Both flaws score in the critical range, and both trace back to the same part of the system: the web-facing report designer and the Client Access Server that exposes it to end users.

What's Actually Broken

CVE-2026-63017 is an incorrect-authorization flaw: a low-privileged, authenticated user can reach resources that should be restricted to administrators, effectively erasing the role boundary the application is supposed to enforce. CVE-2026-63774 is a SQL injection in the report designer itself, caused by insufficient validation of input the designer passes through to the underlying database — a classic web-application input-handling gap, not a protocol or firmware issue. Both carry a CVSS v3 base score of 9.0 (9.4 on CVSS v4.0), though CISA notes neither is remotely exploitable without network access to the Client Access Server and valid, if low-privileged, credentials.

Why the Client Access Server Is the Real Story

What makes this advisory worth reading past the CVE numbers is where both flaws sit: not in a PLC, not in a field device, but in the browser-based client that operators use every day to pull reports and dashboards out of the system. CISA's own interim mitigation — turning off F12 developer-tools access for Client Access Server users — is a tell that the exposed surface is a conventional web front end, inspectable with the same browser tools any web developer uses, sitting in front of data that controls grid-telemetry reporting for utility operators. A role check that can be walked around by a low-privileged account, and an input field that reaches the database without validation, are exactly the defects a web-application security review is built to catch before a product like this ships to the field.

Patch the Software, but Audit the Interface

Subnet Solutions' fix — Update 1.1 for the 2026 branch, Update 30 for 2020 — closes both CVEs, and utilities running affected versions should schedule it rather than relying on the F12-access workaround long-term. The harder question for any operator maintaining a similar reporting portal in-house is whether the same two defect classes exist in their own web client: role checks enforced only in the UI instead of the back end, or report/query builders that concatenate user input into SQL without parameterization. Those are findings a dedicated web-application audit surfaces reliably, and they are exactly the kind of role-based access control and input-validation work that goes into building a secure reporting portal from the start rather than patching one after a CVE forces the issue.

YuSMP Group builds and audits web-based operator portals and reporting interfaces for industrial and utility clients, including the role-based access control and input-validation work that keeps a report designer like this one from becoming the next ICSA advisory.

Sources: CISA ICS Advisory ICSA-26-307-01, November 3, 2026; ISSSource, "Subnet Solutions Fixes PowerSYSTEM Center," November 2026.