{"id":"CVE-2026-63774","kind":"vulnerability","aliases":["CVE-2026-63774"],"related":[],"title":"PowerSYSTEM Center 2024 and 2026: report designer SQL injection for logged-in users","description":"Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.","summary":"SQL injection in the PowerSYSTEM Center report designer (CWE-89): insufficient input validation lets an authenticated user on an adjacent network run unauthorized SQL commands. CISA reports no known exploitation and says it is not remotely exploitable. Fix: 2026 Update 1.1.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PowerSYSTEM Center 2024","fixed":["2026 Update 1.1"],"affected":">=6.0.x, <=6.2.x","ecosystem":"vendor"},{"name":"PowerSYSTEM Center 2026","fixed":["2026 Update 1.1"],"affected":">=7.0.x, <=7.1.x","ecosystem":"vendor"}],"ecosystems":[],"tags":["energy","ics","other","powersystem-center","reporting","sql","sql-injection","subnet-solutions"],"not_affected_if":["report-designer-disabled","unauthenticated-only-access"],"how_to_check":"Check your PowerSYSTEM Center version. Affected: 2024 branch 6.0.x to 6.2.x and 2026 branch 7.0.x to 7.1.x. The 2020 branch (<=5.29.x) is not listed for this CVE (it is for the sibling CVE-2026-63017). Also check whether users can open the report designer.","fix":"Update to PowerSYSTEM Center 2026 Update 1.1 (2024 users are told to upgrade to 2026 Update 1.1). Contact Subnet Solutions integration/support (support@subnet.com). If you cannot update, disable user access to the report designer.","status":"open","published_at":"2026-11-06T01:17:50+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","triaged_at":"2026-11-06T01:19:17+00:00","updated_at":"2026-11-06T01:20:15+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-06T01:19:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PowerSYSTEM Center report designer: input flaw lets users run SQL","impact":"high","summary":"PowerSYSTEM Center's report designer does not validate input properly. An authenticated user can run unauthorized SQL commands against the database behind it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["powersystem-center","sql","reporting"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads or changes database contents via SQL","analyst_note":"Find the affected PowerSYSTEM Center versions, the fixed release and vendor advisory; NVD entry lacks product ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"Organisations running PowerSYSTEM Center with the report designer in use. Exposure requires a logged-in account; the sources do not say which versions are affected or whether the designer is enabled by default. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000624,"input_tokens":4170,"output_tokens":414,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected PowerSYSTEM Center versions, the fixed release and vendor advisory; NVD entry lacks product ranges.","search":"'-2026':16A,19A '-63774':17A,20A '-89':50B '1.1':81B '2024':3A,23A '2026':5A,26A,79B 'adjac':60B 'allow':91C 'authent':56B,93C 'center':2A,22A,25A,32B,46B,88C 'cisa':66B 'command':65B,99C 'cve':15A,18A 'cwe':49B 'design':7A,48B,90C 'energi':27B 'execut':96C 'exploit':70B,77B 'fix':78B 'ic':28B 'inject':9A,37B,42B 'input':52B,83C 'insuffici':51B,82C 'known':69B 'let':54B 'log':12A 'logged-in':11A 'network':61B 'powersystem':1A,21A,24A,31B,45B,87C 'powersystem-cent':30B 'remot':76B 'report':6A,33B,47B,67B,89C 'run':62B 'say':72B 'solut':40B 'sql':8A,34B,36B,41B,64B,98C 'sql-inject':35B 'subnet':39B 'subnet-solut':38B 'unauthor':63B,97C 'updat':80B 'user':14A,57B,94C 'valid':53B,84C","nicknames":[],"mitigations":[],"who_affected":"Organisations running PowerSYSTEM Center 2024 (6.0.x-6.2.x) or 2026 (7.0.x-7.1.x), mostly energy and critical manufacturing. Exposure needs a low-privileged logged-in account on an adjacent network. Can skip it: 2020 branch for this CVE, or installs where nobody can reach the report designer.","tier":"B","verified":{"fix":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849},"products":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849},"mitigations":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849},"workarounds":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849},"how_to_check":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849},"who_affected":{"at":"2026-11-06T01:20:15Z","by":"analyst","doc":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","run_id":1849}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["center2024","center2026","powersystemcenter2024","powersystemcenter2026"],"ptokens":["2024","2026","center","powersystem"],"labels":["critical","energy","ics","other","powersystemcenter","reporting","sql","sqlinjection","subnetsolutions"],"campaign_type":null,"search_a":"'-2026':16A,19A '-63774':17A,20A '2024':3A,23A '2026':5A,26A 'center':2A,22A,25A 'cve':15A,18A 'design':7A 'inject':9A 'log':12A 'logged-in':11A 'powersystem':1A,21A,24A 'report':6A 'sql':8A 'user':14A","search_b":"'-89':50B '1.1':81B '2026':79B 'adjac':60B 'authent':56B 'center':32B,46B 'cisa':66B 'command':65B 'cwe':49B 'design':48B 'energi':27B 'exploit':70B,77B 'fix':78B 'ic':28B 'inject':37B,42B 'input':52B 'insuffici':51B 'known':69B 'let':54B 'network':61B 'powersystem':31B,45B 'powersystem-cent':30B 'remot':76B 'report':33B,47B,67B 'run':62B 'say':72B 'solut':40B 'sql':34B,36B,41B,64B 'sql-inject':35B 'subnet':39B 'subnet-solut':38B 'unauthor':63B 'updat':80B 'user':57B 'valid':53B","search_c":"'allow':91C 'authent':93C 'center':88C 'command':99C 'design':90C 'execut':96C 'input':83C 'insuffici':82C 'powersystem':87C 'report':89C 'sql':98C 'unauthor':97C 'user':94C 'valid':84C","first_public_at":"2026-11-06T01:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63774","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63774","severity":null,"published_at":"2026-11-06T01:17:50+00:00","modified_at":"2026-11-06T01:17:50+00:00","first_seen_at":"2026-11-06T01:19:01+00:00","fetched_at":"2026-11-06T01:19:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63774:1849","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","severity":null,"published_at":"2026-11-06T01:20:15+00:00","modified_at":"2026-11-06T01:20:15+00:00","first_seen_at":"2026-11-06T01:20:15+00:00","fetched_at":"2026-11-06T01:20:15+00:00","note":"Read CISA ICSA-26-307-01 (carries Subnet Solutions remediation text). No vendor-site page found; 2020 branch not affected by this CVE. Not exploited per CISA.","cites":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01"]}],"documents":[{"id":82420,"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","title":"CISA ICSA-26-307-01 Subnet Solutions PowerSYSTEM Center","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}