POWERSYSTEM CENTER 2024 · CVE-2026-63774 · Other
FIX → 2026 Update 1.1 ✓ verified
SQL injection in the PowerSYSTEM Center report designer (CWE-89): insufficient input validation lets an authenticated user on an adjacent network run unauthorized SQL commands. CISA reports no known exploitation and says it is not remotely exploitable. Fix: 2026 Update 1.1.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running PowerSYSTEM Center 2024 (6.0.x-6.2.x) or 2026 (7.0.x-7.1.x), mostly energy and critical manufacturing. Exposure needs a low-privileged logged-in account on an adjacent network. Can skip it: 2020 branch for this CVE, or installs where nobody can reach the report designer.
Not affected if report-designer-disabled, unauthenticated-only-access
Who cares energy, ics, powersystem-center, reporting, sql, sql-injection, subnet-solutions
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026 Update 1.1