{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63774", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-07-27T21:24:52.067Z", "datePublished": "2026-11-06T00:05:00.309Z", "dateUpdated": "2026-11-06T00:05:00.309Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-11-06T00:05:00.309Z"}, "title": "Subnet Solutions PowerSYSTEM Center SQL Injection", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89", "type": "CWE"}]}], "affected": [{"vendor": "Subnet Solutions", "product": "PowerSYSTEM Center 2024", "versions": [{"status": "affected", "version": "6.0.x", "lessThanOrEqual": "6.2.x", "versionType": "custom"}, {"status": "unaffected", "version": "PowerSYSTEM Center 2026 Update 1.1"}], "defaultStatus": "unaffected"}, {"vendor": "Subnet Solutions", "product": "PowerSYSTEM Center 2026", "versions": [{"status": "affected", "version": "7.0.x", "lessThanOrEqual": "7.1.x", "versionType": "custom"}, {"status": "unaffected", "version": "Update 1.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands."}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "workarounds": [{"lang": "en", "value": "If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools."}]}], "solutions": [{"lang": "en", "value": "For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected].", "supportingMedia": [{"type": "text/html", "base64": false, "value": "For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. "}]}, {"lang": "en", "value": "Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected].", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. "}]}], "credits": [{"lang": "en", "value": "Chinmay Patel of Digital Boundary Group reported this vulnerability to Subnet Solutions.", "type": "finder"}], "source": {"advisory": "ICSA-26-307-01", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerSYSTEM Center 2024", "vendor": "Subnet Solutions", "versions": [{"lessThanOrEqual": "6.2.x", "status": "affected", "version": "6.0.x", "versionType": "custom"}, {"status": "unaffected", "version": "PowerSYSTEM Center 2026 Update 1.1"}]}, {"defaultStatus": "unaffected", "product": "PowerSYSTEM Center 2026", "vendor": "Subnet Solutions", "versions": [{"lessThanOrEqual": "7.1.x", "status": "affected", "version": "7.0.x", "versionType": "custom"}, {"status": "unaffected", "version": "Update 1.1"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands."}], "id": "CVE-2026-63774", "lastModified": "2026-11-06T01:17:50.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-11-06T01:17:50.470", "references": [{"source": "[email protected]", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json"}, {"source": "[email protected]", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0.x,6.2.x]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "PowerSYSTEM Center 2026 Update 1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerSYSTEM Center 2024", "source": "cna", "vendor": "Subnet Solutions"}, "product": "powersystem_center_2024", "vendor": "subnet_solutions"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.x,7.1.x]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "Update 1.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerSYSTEM Center 2026", "source": "cna", "vendor": "Subnet Solutions"}, "product": "powersystem_center_2026", "vendor": "subnet_solutions"}], "created": "2026-11-06T01:45:14.370234+00:00", "updated": "2026-11-06T02:00:10.167842+00:00", "vendors": ["subnet_solutions", "subnet_solutions$PRODUCT$powersystem_center_2024", "subnet_solutions$PRODUCT$powersystem_center_2026"]}