CVE-2026-63774 PUBLISHED

Subnet Solutions PowerSYSTEM Center SQL Injection

Assigner: icscert
Reserved: 27.07.2026 Published: 06.11.2026 Updated: 06.11.2026

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.4

Product Status

Vendor Subnet Solutions
Product PowerSYSTEM Center 2024
Versions Default: unaffected
  • affected from 6.0.x to 6.2.x (incl.)
  • Version PowerSYSTEM Center 2026 Update 1.1 is unaffected
Vendor Subnet Solutions
Product PowerSYSTEM Center 2026
Versions Default: unaffected
  • affected from 7.0.x to 7.1.x (incl.)
  • Version Update 1.1 is unaffected

Workarounds

If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.

Solutions

Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com.

Credits

  • Chinmay Patel of Digital Boundary Group reported this vulnerability to Subnet Solutions. finder

References

Problem Types

  • CWE-89 CWE