CVE-2026-63774
Subnet Solutions PowerSYSTEM Center SQL Injection
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
Fixes and workarounds
Fix
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected]. Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at [email protected].
Source: CNA: icscertWorkaround
If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.
Source: CNA: icscertAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| PowerSYSTEM Center 2024 Subnet Solutions |
≥ 6.0.x; ≤ 6.2.x (affected, custom) PowerSYSTEM Center 2026 Update 1.1 (unaffected) Other versions: unaffected |
CNA: icscert |
| PowerSYSTEM Center 2026 Subnet Solutions |
≥ 7.0.x; ≤ 7.1.x (affected, custom) Update 1.1 (unaffected) Other versions: unaffected |
CNA: icscert |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 9.0 critical |
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | CNA: icscert |
| 4.0 / 9.4 critical |
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | CNA: icscert |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.