Read the docs
TI-2026-85713 Aliases CVE-2026-63017GHSA-m3vg-mr9j-3fv3

Incorrect authorization in Subnet Solutions PowerSYSTEM Center

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Subnet Solutions PowerSYSTEM Center 2020 from 0 through 5.29.x, PowerSYSTEM Center 2024 from 6.0.x through 6.2.x, and PowerSYSTEM Center 2026 from 7.0.x through 7.1.x are affected. Incorrect authorization (CWE-863) lets a low-privileged user access resources normally limited to administrators. An authenticated attacker on an adjacent network with low privileges can do this without user interaction, with high impact to confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

Why it matters now

EPSS 0.00266 18th percentileScored 2026-11-07
Fix Fixed PowerSYSTEM Center 2020 (Subnet Solutions): Update 30PowerSYSTEM Center 2024 (Subnet Solutions): PowerSYSTEM Center 2026 Update 1.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Subnet SolutionsPowerSYSTEM Center 2020up to 5.29.xUpdate 30Patch availableCNA
Subnet SolutionsPowerSYSTEM Center 20246.0.x – 6.2.xPowerSYSTEM Center 2026 Update 1.1Patch availableCNA
Subnet SolutionsPowerSYSTEM Center 20267.0.x – 7.1.xUpdate 1.1Patch availableCNA
  • PowerSYSTEM Center 2020 VendorSubnet Solutions Affected up to 5.29.x Fixed in Update 30 Patch available CNA
  • PowerSYSTEM Center 2024 VendorSubnet Solutions Affected 6.0.x – 6.2.x Fixed in PowerSYSTEM Center 2026 Update 1.1 Patch available CNA
  • PowerSYSTEM Center 2026 VendorSubnet Solutions Affected 7.0.x – 7.1.x Fixed in Update 1.1 Patch available CNA

Remediation

Update PowerSYSTEM Center 2020 to Update 30, PowerSYSTEM Center 2024 to PowerSYSTEM Center 2026 Update 1.1, and PowerSYSTEM Center 2026 to Update 1.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA PowerSYSTEM Center 2020 (Subnet Solutions) Fixed in Update 30
  • Fix · CNA PowerSYSTEM Center 2024 (Subnet Solutions) Fixed in PowerSYSTEM Center 2026 Update 1.1
  • Fix · CNA PowerSYSTEM Center 2026 (Subnet Solutions) Fixed in Update 1.1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63017
  2. 2026-11-06 Alias added: GHSA-m3vg-mr9j-3fv3

References

Other 2

  • TI-2014-01872 SUBNET SubSTATION Server 2 Telegyr 8979 Master Protocol Improper Input Validation CVSS 2.0HIGH 8.3
  • TI-2026-85714 SQL injection in Subnet Solutions PowerSYSTEM Center report designer CVSS 4.0CRITICAL 9.4
  • TI-2023-13589 SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay CVSS 3.1CRITICAL 9.1
  • TI-2024-18636 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
  • TI-2024-17121 SUBNET Substation Server Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
  • TI-2024-03105 SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences