What happened
CISA published ICSA-26-307-01 at 06:00 UTC on 3 November 2026. CVE-2026-63017 allows a low-privileged authenticated user to access administrator-only resources and affects PowerSYSTEM Center 2020 through 5.29.x, 2024 versions 6.0.x through 6.2.x, and 2026 versions 7.0.x through 7.1.x. CVE-2026-63774 is an SQL injection in the report designer and affects PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x and 2026 versions 7.0.x through 7.1.x.
Both vulnerabilities have a CVSS v3.1 base score of 9.0 with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CISA says the vulnerabilities require a low-privileged authenticated user on an adjacent network and are not remotely exploitable. Attribution posture: No actor is involved in the disclosure, and no public exploitation has been reported to CISA.
PowerSYSTEM Center 2020 should move to Update 30; PowerSYSTEM Center 2024 and 2026 should move to PowerSYSTEM Center 2026 Update 1.1. If an upgrade cannot be completed, Subnet Solutions recommends monitoring user activity, disabling Client Access Server users’ access to browser F12 Developer Tools and disabling report-designer access where applicable. CISA’s broader guidance also calls for minimising control-system exposure and isolating control networks from business networks. The cited source did not publish the specific indicators described as No indicators of compromise were published because exploitation was not reported.
Why this matters now
PowerSYSTEM Center occupies a privileged position between engineering users and substation or field devices. A low-privileged account reaching administrator resources or issuing database commands can expose device settings, credentials, reports and change history even though the vulnerabilities are not remotely exploitable from the public internet.
The adjacent-network and authenticated prerequisites reduce immediate exposure compared with a perimeter zero-day, but they align with realistic OT access paths: compromised technician credentials, vendor remote access, shared engineering workstations or an insider account. The decision should therefore combine patching with identity review and log validation rather than rely on network location as sufficient protection.
OT upgrade windows may be constrained by safety and availability requirements. That does not justify an open-ended exception. Operators need a plant-safe implementation date, temporary feature restrictions, named risk ownership and explicit evidence that affected management functions are not exposed to unnecessary users while the change is pending.
The decision for security leaders
Treat the platform as a privileged OT management system, not an ordinary reporting application. Upgrade priority should reflect the device settings, passwords and operational records reachable through the server, alongside the business impact of the change window.
Use the authenticated-access prerequisite to focus identity containment. Review ordinary users, contractor accounts, support identities and engineering workstations that can reach PowerSYSTEM Center, then remove dormant access and require an approved purpose for report-designer use.
Where immediate upgrading is unsafe, approve a time-bounded exception that records the affected instance, operational owner, compensating feature restrictions, monitored logs, planned change window and escalation path for any unexplained administrative or SQL activity.
Evidence of closure
- Version evidence confirms 2020 Update 30 or 2026 Update 1.1 on every affected instance.
- Account review approves each low-privileged, contractor and vendor identity.
- Network validation confirms PowerSYSTEM Center is reachable only from approved adjacent segments.
- Activity logs show no unexplained administrator-resource or SQL access during the exposure period.Exceptions record compensating controls, accountable owner and expiry for each unpatched instance.Change records demonstrate that upgrades were tested against protection settings, report functions and recovery procedur.
The Security.io assessment
No public exploitation is reported, and the vulnerabilities require adjacent-network access plus a valid low-privileged account. That makes this a controlled remediation decision rather than an emergency internet-perimeter response. It does not make the issue low consequence because the affected product sits in an operational management path.
CISA published no indicators of compromise because no public exploitation was reported. Operators therefore cannot rely on a standard IOC hunt. Assurance must come from version inventory, identity review, network-path validation and examination of application activity for access to administrator-only resources or unexpected database operations.
The vendor’s temporary restrictions reduce reachable functionality but are not equivalent to a fix. Monitoring acceptable-use records and disabling browser developer tools may constrain known paths, yet they do not provide durable assurance against every variation of an authorisation or input-validation flaw. Exceptions should expire at the next defensible plant-safe upgrade opportunity.
Questions for the morning meeting
- Where are affected PowerSYSTEM Center versions deployed?
- Which low-privileged or contractor accounts can reach the report designer?
- What plant-safe window is available for the required upgrade?
- Can activity logs prove no unauthorised administrative or SQL access occurred?