PowerSYSTEM Center: verify updates and account boundaries
An authenticated account still needs to respect its role boundaries. The PowerSYSTEM Center flaws call for acceptance by product, update and effective authorization.
Leer en portuguésBy Pentesty
Include the authenticated account in the risk scenario
The CISA advisory dated November 3, 2026 describes two vulnerabilities in Subnet Solutions PowerSYSTEM Center. CVE-2026-63017 concerns incorrect authorization: an authenticated account with low privileges can reach administrative resources. CVE-2026-63774 involves unauthorized SQL commands through the report designer. This does not establish operating-system command execution or changes to industrial processes. Keep those potential effects separate from the published findings.
Both receive a CVSS v3.1 score of 9.0, with an adjacent attack vector, low privileges and no user interaction. In that advisory, CISA said no known public exploitation had been reported and that the flaws were not remotely exploitable. Preserve that technical and temporal scope. The November 9 news report does not change the advisory date or establish a new incident.
Use each CVE’s product matrix
In the official CSAF JSON, CVE-2026-63017 includes PowerSYSTEM Center 2020 through 5.29.x, 2024 from 6.0.x through 6.2.x and 2026 from 7.0.x through 7.1.x. CVE-2026-63774 lists only the 2024 and 2026 ranges. The HTML presentation repeats 2020 in the SQL panel; retain that presentation discrepancy and consult the explicit per-CVE matrix in the structured document.
Upgrade guidance differs by product family. Do not turn a marketed update name into an assumed build number. Connect the actual installation to the package and vendor guidance before accepting the change. Record any unresolved version mapping as a question for the responsible team.
- PowerSYSTEM Center 2020: Update 30 for affected installations.
- PowerSYSTEM Center 2024: upgrade to PowerSYSTEM Center 2026 Update 1.1.
- PowerSYSTEM Center 2026: Update 1.1, following the guidance cited by CISA.
Plan the change with operations
The business needs to identify where the product runs, which components participate in the service and who approves maintenance. Record the observed version and functions operators use. Prepare a configuration baseline and an approved recovery procedure, considering dependencies that need to remain available during the maintenance window. Name an owner for the final decision.
CISA recommends impact and risk assessment before defensive measures. In Pentesty’s proposed exercise, first test representative workflows in an agreed environment: authentication, a lookup and a report using fictional data. Compare results before and after the change, also recording which component actually received the update. Retain exceptions instead of marking an entire deployment complete from one installation.
Check the boundary at the receiving service
For authorization, use two test accounts with different roles. Demonstrate an operation permitted for the lower-privilege account and an administrative function it must be denied. Observe the receiving service’s decision together with the identity and resource. A restricted-looking interface does not establish which operations the server accepts. Include the expected decision in the evidence before testing.
For the report designer, confirm who should use it and which data sources it may reach. Functional acceptance can begin with approved synthetic reports and permission checks. A specialized exploitation investigation needs its own scope and isolation; do not run dangerous SQL commands in production as an automatic prerequisite for closing the update.
Define the scope and review point of interim measures
For deployments that cannot update immediately, the advisory attributes recommendations to the vendor to monitor activity and restrict browser F12 access for Client Access Server users. For SQL, it recommends restricting the report designer. Record these as interim measures with an owner and review condition. An interface restriction does not establish effective server-side authorization.
Our analysis of refrigeration remote access complements the network-boundary discussion but concerns a separate case. Here, identify the paths actually available to the installation and their dependencies. Do not confuse a segmentation diagram with evidence of enforcement or expand testing to industrial equipment outside the authorized scope.
Close with version, permissions and functionality verified
The final record should connect product family, adopted update, observed component, test accounts and permitted or denied outcomes. Our EPICS compatibility analysis helps consider clients and dependencies during a change. Retain unresolved questions with named owners whenever a stage cannot be verified, rather than silently treating that stage as accepted.
This acceptance describes one deployment and the scenarios examined. It does not prove the absence of earlier access or justify concluding that every account or integration is protected. Investigating suspicious activity is a separate task supported by defined records and a time window. Change approval needs to make these boundaries visible to operations.
Frequently asked questions
Do the flaws allow anonymous internet access?
The advisory describes authenticated accounts with low privileges and an adjacent vector. In the November 3 notice, CISA says the vulnerabilities are not remotely exploitable.
Does CVE-2026-63774 include the 2020 product?
The official JSON lists only the 2024 and 2026 ranges for this CVE. The HTML presentation contains a conflicting repetition; use the explicit per-CVE matrix and confirm the installation with the vendor.
Does blocking F12 complete remediation?
The advisory presents this as interim guidance attributed to the vendor. Record its scope and verify authorization at the service while retaining the upgrade plan and open questions.
How can we verify an update without exploiting the flaw?
Connect the package to the running component and test authorized functions with fictional accounts and data. Retain permissions, outcomes and limits; exploitation reproductions need specialist assessment and a separate scope.
Sources and references
- CISA: advisory ICSA-26-307-01, November 3, 2026
- CISA CSAF: official per-CVE matrix and product recommendations
Original Pentesty analysis, published November 9, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.