POWERSYSTEM CENTER 2020 · CVE-2026-63017 · Infrastructure
FIX → Update 30 · 2026 Update 1.1 ✓ verified
Incorrect authorization (CWE-863) in Subnet Solutions PowerSYSTEM Center lets a low-privileged, authenticated user reach administrator-only resources. CVSS 3.1 9.0, adjacent network. CISA reports no known exploitation. Without updating, Subnet Solutions advises monitoring user activity records and blocking Client Access Server users from the browser F12 Developer Tools.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Subnet Solutions PowerSYSTEM Center (energy and critical manufacturing) 2020 up to 5.29.x, 2024 6.0.x-6.2.x or 2026 7.0.x-7.1.x. An attacker needs a low-privileged login and adjacent-network access, then can reach administrator-only resources. Installs already on 2020 Update 30 or 2026 Update 1.1 can skip it.
Not affected if auth-required, unknown
Who cares authorization, energy, ics, powersystem-center, self-hosted, subnet-solutions
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to Update 30 · 2026 Update 1.1