# CVE-2026-63017: Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

## Remediation

- fix: For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com.

Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com.

Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. (source: CNA: icscert)
- workaround: If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools. (source: CNA: icscert)

## Affected products and versions

- Subnet Solutions / PowerSYSTEM Center 2020: ≥ 0; ≤ 5.29.x (affected, custom); Update 30 (unaffected). Source: CNA: icscert
- Subnet Solutions / PowerSYSTEM Center 2024: ≥ 6.0.x; ≤ 6.2.x (affected, custom); PowerSYSTEM Center 2026 Update 1.1 (unaffected). Source: CNA: icscert
- Subnet Solutions / PowerSYSTEM Center 2026: ≥ 7.0.x; ≤ 7.1.x (affected, custom); Update 1.1 (unaffected). Source: CNA: icscert

## Severity and prioritization

- CVSS 3.1: 9 (critical); CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; source: CNA: icscert

- CVSS 4.0: 9.4 (critical); CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; source: CNA: icscert

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01 (CNA: icscert)

- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json (CNA: icscert)

## Provenance

- CNA: icscert: https://www.cve.org/CVERecord?id=CVE-2026-63017; retrieved 2026-11-06; source updated 2026-11-06

Revision: 696c419f9e8dd0d3a3e24ae79678a626d634fa15e02d63003a2c04aba5e1da62

Canonical: https://y2.dev/cve/CVE-2026-63017

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.