---
id: "CVE-2026-63017"
page: "https://infrastack.ai/live/CVE-2026-63017"
kind: "vulnerability"
aliases: ["CVE-2026-63017"]
title: "PowerSYSTEM Center: low-privileged user can reach administrator-only resources (2020, 2024, 2026 branches)"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "PowerSYSTEM Center 2020", "fixed": ["Update 30"], "affected": "<= 5.29.x", "ecosystem": "vendor"}, {"name": "PowerSYSTEM Center 2024", "fixed": ["2026 Update 1.1"], "affected": ">= 6.0.x, <= 6.2.x", "ecosystem": "vendor"}, {"name": "PowerSYSTEM Center 2026", "fixed": ["2026 Update 1.1"], "affected": ">= 7.0.x, <= 7.1.x", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authorization", "energy", "ics", "infrastructure", "powersystem-center", "self-hosted", "subnet-solutions"]
not_affected_if: ["auth-required", "unknown"]
published_at: "2026-11-06T01:17:50+00:00"
first_seen_at: "2026-11-06T01:19:01+00:00"
updated_at: "2026-11-06T01:20:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63017", "first_seen_at": "2026-11-06T01:19:01+00:00"}, {"source": "analyst", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01", "first_seen_at": "2026-11-06T01:20:32+00:00", "cites": ["https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01"]}]
exploit_sources: []
---

# PowerSYSTEM Center: low-privileged user can reach administrator-only resources (2020, 2024, 2026 branches)

Link for people: https://infrastack.ai/live/CVE-2026-63017 (this .md is for agents)

Incorrect authorization (CWE-863) in Subnet Solutions PowerSYSTEM Center lets a low-privileged, authenticated user reach administrator-only resources. CVSS 3.1 9.0, adjacent network. CISA reports no known exploitation. Without updating, Subnet Solutions advises monitoring user activity records and blocking Client Access Server users from the browser F12 Developer Tools.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PowerSYSTEM Center 2020 affected <= 5.29.x fixed Update 30
- vendor:PowerSYSTEM Center 2024 affected >= 6.0.x, <= 6.2.x fixed 2026 Update 1.1
- vendor:PowerSYSTEM Center 2026 affected >= 7.0.x, <= 7.1.x fixed 2026 Update 1.1

## How to check

Check your installed PowerSYSTEM Center branch and version: 2020 up to 5.29.x, 2024 6.0.x-6.2.x, or 2026 7.0.x-7.1.x are affected. Also check whether ordinary users can reach the Client Access Server from the network.

## Fix

PowerSYSTEM Center 2020: install Update 30. PowerSYSTEM Center 2024 and 2026: upgrade to PowerSYSTEM Center 2026 Update 1.1.

## Timeline

- 2026-11-06T01:19:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63017
- 2026-11-06T01:20:32+00:00 analyst https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01 — Read CISA ICSA-26-307-01 (relays Subnet Solutions remediation). No exploitation known per CISA; adjacent-network, authenticated. Vendor's own bulletin not found.

## Documents

- [advisory] CISA ICSA-26-307-01 Subnet Solutions PowerSYSTEM Center https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01

## From the sources

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_