Two critical bugs in Subnet Solutions PowerSYSTEM Center give low-level users admin reach

Key points

• Chinmay Patel of Digital Boundary Group reported two critical flaws in Subnet Solutions PowerSYSTEM Center, a Canadian-built management tool used by energy and critical manufacturing operators worldwide, both scored 9.4 out of 10 under CVSS 4.0.
• CVE-2026-63017 lets a logged-in user with low privileges reach resources that should be admin-only.
• CVE-2026-63774 lets a logged-in user run their own database commands through the report designer.
• Fixed versions are PowerSYSTEM Center 2020 Update 30 and PowerSYSTEM Center 2026 Update 1.1; the 2024 line gets no patch and users are told to migrate to 2026.
• CISA's advisory repeats its standard instruction: do not expose industrial control systems to the public internet.

Subnet Solutions, a Calgary-based vendor whose PowerSYSTEM Center software is used by electrical utilities and industrial plants to manage substation data, has two critical holes in its product. Both were disclosed to CISA by researcher Chinmay Patel of Digital Boundary Group, with the vendor filing separately. Each carries a CVSS 4.0 base score of 9.4 and a CVSS 3.1 score of 9.0. Both require a valid, low-privileged login and a path onto the adjacent network rather than the open internet.

What do the two bugs actually do?

One is a permissions failure. The other is SQL injection, meaning the software can't tell the difference between a user's typed input and a real database command, so a crafted entry gets executed against the back-end database.

CVE-2026-63017 is the authorization flaw (CWE-863). An ordinary account holder can reach pages and functions the software is supposed to reserve for administrators. In an operations centre where accounts go out to engineers and contractors, that distinction matters more than vendors tend to admit.

CVE-2026-63774 sits in the report designer feature (CWE-89). Authenticated users can feed it input that passes straight to the database, exposing records the application was never meant to surface.

Which versions are affected and what should operators install?

Three product lines are in scope. The fix path depends on which one you run.

Operators who can't patch immediately are told to monitor user activity logs and disable access to the browser's F12 developer tools inside the Client Access Server. For the SQL injection bug specifically, the interim step is to turn off user access to the report designer entirely. Subnet's support line is (403) 270-8885.

Should plant operators be worried?

Neither flaw is remotely exploitable from the public internet on its own: the attacker needs an account and a foothold on the control network. The problem is that in utility environments both are easier to come by than they should be, through a contractor laptop or a VPN that was meant to be temporary years ago. As we reported on 24 September, CISA and the FBI have already flagged exactly that exposure path for third-party ICS integrators.

CISA's advisory restates the familiar guidance: keep these systems off the internet, sit them behind firewalls, and route remote access through a patched VPN. That advice hasn't changed, and yet here we are.

The SQL injection is the one to prioritise. An authorization bypass is serious, but a report designer that executes attacker-supplied database commands is a direct route to the operational data these platforms exist to protect. Patch the 2026 line to Update 1.1, move 2024 users onto 2026, and disable the report designer for anyone who doesn't strictly need it while you work through the queue.