{"id":"CVE-2026-63017","kind":"vulnerability","aliases":["CVE-2026-63017"],"related":[],"title":"PowerSYSTEM Center: low-privileged user can reach administrator-only resources (2020, 2024, 2026 branches)","description":"Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.","summary":"Incorrect authorization (CWE-863) in Subnet Solutions PowerSYSTEM Center lets a low-privileged, authenticated user reach administrator-only resources. CVSS 3.1 9.0, adjacent network. CISA reports no known exploitation. Without updating, Subnet Solutions advises monitoring user activity records and blocking Client Access Server users from the browser F12 Developer Tools.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerSYSTEM Center 2020","fixed":["Update 30"],"affected":"<= 5.29.x","ecosystem":"vendor"},{"name":"PowerSYSTEM Center 2024","fixed":["2026 Update 1.1"],"affected":">= 6.0.x, <= 6.2.x","ecosystem":"vendor"},{"name":"PowerSYSTEM Center 2026","fixed":["2026 Update 1.1"],"affected":">= 7.0.x, <= 7.1.x","ecosystem":"vendor"}],"ecosystems":[],"tags":["authorization","energy","ics","infrastructure","powersystem-center","self-hosted","subnet-solutions"],"not_affected_if":["auth-required","unknown"],"how_to_check":"Check your installed PowerSYSTEM Center branch and version: 2020 up to 5.29.x, 2024 6.0.x-6.2.x, or 2026 7.0.x-7.1.x are affected. Also check whether ordinary users can reach the Client Access Server from the network.","fix":"PowerSYSTEM Center 2020: install Update 30. PowerSYSTEM Center 2024 and 2026: upgrade to PowerSYSTEM Center 2026 Update 1.1.","status":"open","published_at":"2026-11-06T01:17:50+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","triaged_at":"2026-11-06T01:19:18+00:00","updated_at":"2026-11-06T01:20:32+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-06T01:19:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"PowerSYSTEM Center: low-privileged user can reach administrator-only resources","impact":"high","summary":"PowerSYSTEM Center has an incorrect authorization flaw that lets a low-privileged, logged-in user access resources normally limited to administrators. An attacker with a basic account could read or act on admin-level functions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["powersystem-center"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Low-privileged account reaches administrator-only resources and functions","analyst_note":"Find the affected version ranges, vendor advisory and fixed release for PowerSYSTEM Center; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-63017 gave only the description.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running PowerSYSTEM Center where regular authenticated users have accounts. The sources do not state which versions or deployment modes are affected, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000644,"input_tokens":4174,"output_tokens":454,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected version ranges, vendor advisory and fixed release for PowerSYSTEM Center; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-63017 gave only the description.","search":"'-2026':18A,21A '-63017':19A,22A '-863':48B '2020':13A,25A '2024':14A,28A '2026':15A,31A '3.1':67B '9.0':68B 'access':88B,110C 'activ':83B 'adjac':69B 'administr':10A,63B,115C 'administrator-on':9A,62B 'advis':80B 'allow':102C 'authent':59B,107C 'author':32B,46B,98C 'block':86B 'branch':16A 'browser':93B 'center':2A,24A,27A,30A,38B,53B,101C 'cisa':71B 'client':87B 'cve':17A,20A 'cvss':66B 'cwe':47B 'develop':95B 'energi':33B 'exploit':75B 'f12':94B 'host':41B 'ic':34B 'incorrect':45B,97C 'infrastructur':35B 'known':74B 'let':54B 'limit':113C 'low':4A,57B,105C 'low-privileg':3A,56B,104C 'monitor':81B 'network':70B 'normal':112C 'powersystem':1A,23A,26A,29A,37B,52B,100C 'powersystem-cent':36B 'privileg':5A,58B,106C 'reach':8A,61B 'record':84B 'report':72B 'resourc':12A,65B,111C 'self':40B 'self-host':39B 'server':89B 'solut':44B,51B,79B 'subnet':43B,50B,78B 'subnet-solut':42B 'tool':96B 'updat':77B 'user':6A,60B,82B,90B,108C 'without':76B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Subnet Solutions PowerSYSTEM Center (energy and critical manufacturing) 2020 up to 5.29.x, 2024 6.0.x-6.2.x or 2026 7.0.x-7.1.x. An attacker needs a low-privileged login and adjacent-network access, then can reach administrator-only resources. Installs already on 2020 Update 30 or 2026 Update 1.1 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-06T01:20:32Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1850},"workarounds":{"at":"2026-11-06T01:20:32Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1850}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["center2020","center2024","center2026","powersystemcenter2020","powersystemcenter2024","powersystemcenter2026"],"ptokens":["2020","2024","2026","center","powersystem"],"labels":["authorization","critical","energy","ics","infrastructure","powersystemcenter","selfhosted","subnetsolutions"],"campaign_type":null,"search_a":"'-2026':18A,21A '-63017':19A,22A '2020':13A,25A '2024':14A,28A '2026':15A,31A 'administr':10A 'administrator-on':9A 'branch':16A 'center':2A,24A,27A,30A 'cve':17A,20A 'low':4A 'low-privileg':3A 'powersystem':1A,23A,26A,29A 'privileg':5A 'reach':8A 'resourc':12A 'user':6A","search_b":"'-863':48B '3.1':67B '9.0':68B 'access':88B 'activ':83B 'adjac':69B 'administr':63B 'administrator-on':62B 'advis':80B 'authent':59B 'author':32B,46B 'block':86B 'browser':93B 'center':38B,53B 'cisa':71B 'client':87B 'cvss':66B 'cwe':47B 'develop':95B 'energi':33B 'exploit':75B 'f12':94B 'host':41B 'ic':34B 'incorrect':45B 'infrastructur':35B 'known':74B 'let':54B 'low':57B 'low-privileg':56B 'monitor':81B 'network':70B 'powersystem':37B,52B 'powersystem-cent':36B 'privileg':58B 'reach':61B 'record':84B 'report':72B 'resourc':65B 'self':40B 'self-host':39B 'server':89B 'solut':44B,51B,79B 'subnet':43B,50B,78B 'subnet-solut':42B 'tool':96B 'updat':77B 'user':60B,82B,90B 'without':76B","search_c":"'access':110C 'administr':115C 'allow':102C 'authent':107C 'author':98C 'center':101C 'incorrect':97C 'limit':113C 'low':105C 'low-privileg':104C 'normal':112C 'powersystem':100C 'privileg':106C 'resourc':111C 'user':108C","first_public_at":"2026-11-06T01:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63017","severity":null,"published_at":"2026-11-06T01:17:50+00:00","modified_at":"2026-11-06T01:17:50+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","fetched_at":"2026-11-06T01:19:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63017:1850","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","severity":null,"published_at":"2026-11-06T01:20:32+00:00","modified_at":"2026-11-06T01:20:32+00:00","first_seen_at":"2026-11-06T01:20:32+00:00","fetched_at":"2026-11-06T01:20:32+00:00","note":"Read CISA ICSA-26-307-01 (relays Subnet Solutions remediation). No exploitation known per CISA; adjacent-network, authenticated. Vendor's own bulletin not found.","cites":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01"]}],"documents":[{"id":82420,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","title":"CISA ICSA-26-307-01 Subnet Solutions PowerSYSTEM Center","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}