Read the docs
TI-2026-85714 Aliases CVE-2026-63774GHSA-vjfv-8hxx-fpqj

SQL injection in Subnet Solutions PowerSYSTEM Center report designer

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Subnet Solutions PowerSYSTEM Center 2024 from 6.0.x through 6.2.x and PowerSYSTEM Center 2026 from 7.0.x through 7.1.x are affected. Insufficient input validation in the report designer lets user input alter SQL commands (CWE-89). An authenticated user on an adjacent network can execute unauthorized SQL commands.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Why it matters now

EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Fixed PowerSYSTEM Center 2024 (Subnet Solutions): PowerSYSTEM Center 2026 Update 1.1PowerSYSTEM Center 2026 (Subnet Solutions): Update 1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Subnet SolutionsPowerSYSTEM Center 20246.0.x – 6.2.xPowerSYSTEM Center 2026 Update 1.1Patch availableCNA
Subnet SolutionsPowerSYSTEM Center 20267.0.x – 7.1.xUpdate 1.1Patch availableCNA
  • PowerSYSTEM Center 2024 VendorSubnet Solutions Affected 6.0.x – 6.2.x Fixed in PowerSYSTEM Center 2026 Update 1.1 Patch available CNA
  • PowerSYSTEM Center 2026 VendorSubnet Solutions Affected 7.0.x – 7.1.x Fixed in Update 1.1 Patch available CNA

Remediation

Upgrade PowerSYSTEM Center 2024 to PowerSYSTEM Center 2026 Update 1.1. Upgrade PowerSYSTEM Center 2026 to Update 1.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA PowerSYSTEM Center 2024 (Subnet Solutions) Fixed in PowerSYSTEM Center 2026 Update 1.1
  • Fix · CNA PowerSYSTEM Center 2026 (Subnet Solutions) Fixed in Update 1.1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-63774
  2. 2026-11-06 Alias added: GHSA-vjfv-8hxx-fpqj

References

Other 2

  • TI-2014-01872 SUBNET SubSTATION Server 2 Telegyr 8979 Master Protocol Improper Input Validation CVSS 2.0HIGH 8.3
  • TI-2026-85713 Incorrect authorization in Subnet Solutions PowerSYSTEM Center CVSS 4.0CRITICAL 9.4
  • TI-2023-13589 SUBNET PowerSYSTEM Center Authentication Bypass by Capture-replay CVSS 3.1CRITICAL 9.1
  • TI-2024-18636 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
  • TI-2024-17121 SUBNET Substation Server Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
  • TI-2024-03105 SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component CVSS 4.0HIGH 8.6
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences