CISA ICSA-26-307-01: Critical Authorization Bypass (CVE-2026-63017) and SQL Injection (CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5604 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [SPL]

Flags successful requests to administrative, credential and configuration PowerSYSTEM Center URIs by authenticated accounts missing from the administrator list, the CVE-2026-63017 hunt hypothesis from TL-2026-5604 (low-privileged account accessing administrator-only resources). Covers privilege escalation via incorrect authorization, collection from information repositories, and exposure of stored credentials or configuration files; adds a referer-less direct API call counter as a proxy for browser developer-tools replay. The F12 Developer Tools abuse path itself is client-side and not visible in server logs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548, T1078, T1213, T1552, T1552.001
• Data sources: iis:ms:iis:auto (index=iis), W3CIISLog, sigma:webserver (IIS W3C), lookup:powersystem_admin_users.csv, watchlist:PowerSYSTEMAdmins
• Severity: high
• Confidence: medium

Splunk SPL

index=iis sourcetype="ms:iis:auto" earliest=-24h sc_status IN (200,201,204,302) (cs_uri_stem="*/admin*" OR cs_uri_stem="*/administration*" OR cs_uri_stem="*/api/admin*" OR cs_uri_stem="*/usermanagement*" OR cs_uri_stem="*/configuration*" OR cs_uri_stem="*credential*" OR cs_uri_stem="*web.config*" OR cs_uri_stem="*appsettings*" OR cs_uri_stem="*connectionstring*")
| where cs_username!="-" AND isnotnull(cs_username)
| lookup powersystem_admin_users.csv cs_username OUTPUT is_admin
| where isnull(is_admin)
| eval referer=coalesce(cs_referer,cs_Referer,"-")
| eval f_cred=if(match(lower(cs_uri_stem),"credential|password|secret"),1,0), f_cfg=if(match(lower(cs_uri_stem),"web[.]config|appsettings|connectionstring"),1,0), f_direct_api=if(like(lower(cs_uri_stem),"%/api/%") AND referer="-",1,0)
| eval src_class=if(cidrmatch("10.0.0.0/8",c_ip) OR cidrmatch("172.16.0.0/12",c_ip) OR cidrmatch("192.168.0.0/16",c_ip),"private","non_private")
| stats count dc(cs_uri_stem) as distinct_admin_uris sum(f_cred) as credential_uri_ct sum(f_cfg) as config_uri_ct sum(f_direct_api) as referer_less_api_ct values(cs_uri_stem) as uris min(_time) as first_seen max(_time) as last_seen by cs_username c_ip src_class host
| eval threat="TL-2026-5604 CVE-2026-63017 PowerSYSTEM Center admin-only resource access by non-admin"
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let adminUsers = _GetWatchlist("PowerSYSTEMAdmins") | project csUserName = tostring(SearchKey);
W3CIISLog
| where TimeGenerated > ago(24h)
| where scStatus in ("200", "201", "204", "302")
| where csUserName != "-" and isnotempty(csUserName)
| where csUriStem has_any ("/admin", "/administration", "/api/admin", "/usermanagement", "/configuration", "credential", "web.config", "appsettings", "connectionstring")
| join kind=leftanti adminUsers on csUserName
| extend FCred = tolower(csUriStem) matches regex @"credential|password|secret",
         FCfg = tolower(csUriStem) matches regex @"web[.]config|appsettings|connectionstring",
         FDirectApi = tolower(csUriStem) contains "/api/" and (isempty(csReferer) or csReferer == "-"),
         SrcClass = iff(ipv4_is_private(cIP), "private", "non_private")
| summarize Hits = count(), DistinctUris = dcount(csUriStem), CredentialUriCt = countif(FCred), ConfigUriCt = countif(FCfg), RefererLessApiCt = countif(FDirectApi), Uris = make_set(csUriStem, 25), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by csUserName, cIP, SrcClass, Computer
| project FirstSeen, LastSeen, csUserName, cIP, SrcClass, Computer, Hits, DistinctUris, CredentialUriCt, ConfigUriCt, RefererLessApiCt, Uris

Sigma

title: PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017)
id: 3c9d8e41-6a2b-4f17-b5d0-8e7a1c2d9b02
status: experimental
description: Detects successful requests to administrative or credential/configuration PowerSYSTEM Center URIs by accounts that are not known administrators, the hunt hypothesis for CVE-2026-63017 (TL-2026-5604). Replace the example filter with your real administrator accounts. The F12 Developer Tools abuse path is client-side and not visible in server logs.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63017
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.privilege_escalation
    - attack.t1548
    - attack.initial_access
    - attack.t1078
    - attack.collection
    - attack.t1213
    - attack.credential_access
    - attack.t1552
    - attack.t1552.001
    - cve.2026.63017
logsource:
    category: webserver
detection:
    selection_admin_uri:
        cs-uri-stem|contains:
            - '/admin'
            - '/administration'
            - '/usermanagement'
            - '/configuration'
    selection_cred_cfg_uri:
        cs-uri-stem|contains:
            - 'credential'
            - 'web.config'
            - 'appsettings'
            - 'connectionstring'
    selection_status:
        sc-status:
            - 200
            - 201
            - 204
    filter_known_admins:
        cs-username:
            - 'administrator'
            - 'psc_admin'
    condition: (selection_admin_uri or selection_cred_cfg_uri) and selection_status and not filter_known_admins
falsepositives:
    - Operators or engineers with legitimate delegated administrative duties not in the filter list
    - Service accounts polling configuration endpoints
level: high

Known false positives:

• Delegated operators with legitimate administrative duties missing from the admin list
• Service accounts polling configuration endpoints

Tuning notes: Populate powersystem_admin_users.csv (column cs_username, is_admin=1) and the PowerSYSTEMAdmins Sentinel watchlist (SearchKey = username) before enabling, otherwise every admin URI hit alerts; replace the example filter_known_admins values in the Sigma rule. Replace URI patterns with real admin paths observed in your logs. Correlate with the application's own user activity records, which CISA recommends monitoring.

• 🔒 PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [KQL] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [KQL] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [KQL] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [Sigma] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [Sigma] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [Sigma] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [SPL] · unlock with TL Creds
• 🔒 PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [SPL] · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5604.

Technical analysis

CISA reports no known public exploitation, and patches are available.

PowerSYSTEM Center is grid-equipment management software from SUBNET Solutions Inc. (Canada) used in the Energy and Critical Manufacturing sectors worldwide. CISA published ICSA-26-307-01 on 2026-11-03 (Revision 1, initial publication). The CVE records and NVD entries for both CVEs were published on 2026-11-06.

CVE-2026-63017 (CWE-863, Incorrect Authorization): a low-privileged, authenticated user can access resources normally limited to administrators. Secondary reporting says a user on an adjacent network can view administrator data and open files meant for root, and one outlet suggests this may include configuration data and credentials; the CISA advisory text itself only states access to administrator-only resources. The interim mitigation of restricting Client Access Server users from browser F12 Developer Tools suggests client-side tooling can be used to reach the restricted functionality, but the advisory does not describe the mechanism in more detail.

CVE-2026-63774 (CWE-89, SQL Injection): insufficient input validation in the PowerSYSTEM Center report designer lets an authenticated user execute unauthorized SQL commands. Secondary reporting says this includes arbitrary database queries and modification of stored data. The impact is database command execution; OS-level code execution is not confirmed by any source.

Both flaws carry the same scoring: CVSS v3.1 9.0 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 9.4 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The attack vector is adjacent (not network), complexity is low, privileges required are low, and no user interaction is needed. CISA states the flaws are not exploitable remotely; that statement sits alongside an AV:A vector, so defenders should treat any adjacent-network position or compromised low-privilege account as sufficient to reach exploitation. Affected: PowerSYSTEM Center 2020 up to 5.29.x, 2024 6.0.x to 6.2.x, and 2026 7.0.x to 7.1.x for CVE-2026-63017. For CVE-2026-63774, OpenCVE and the hunt data list the 2024 and 2026 ranges, while CISA's table lists all three lines; the advisory gives no remediation text for CVE-2026-63774 on 2020, so treat the 2020 line as potentially exposed until the vendor confirms.

Fixes: 2020 users upgrade to 2020 Update 30; 2024 users upgrade to PowerSYSTEM Center 2026 Update 1.1; 2026 users apply Update 1.1. Where upgrading is not possible, CISA recommends monitoring user activity records and disabling Client Access Server users' access to browser F12 Developer Tools (CVE-2026-63017) and disabling user access to the report designer (CVE-2026-63774). Credit goes to Chinmay Patel of Digital Boundary Group and to Subnet Solutions (self-reported). No public PoC, IOCs, threat actor attribution, or CISA KEV listing were identified. No network IOCs exist, so no BeaconBeagle correlation was applicable.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1552 Unsecured Credentials

Impact

T1565 Data Manipulation

Remediation

Patches

• PowerSYSTEM Center 2020 Update 30
• PowerSYSTEM Center 2026 Update 1.1 (also the upgrade target for 2024)

Immediate actions

• Upgrade PowerSYSTEM Center 2020 to Update 30
• Upgrade PowerSYSTEM Center 2024 to 2026 Update 1.1
• Apply Update 1.1 to PowerSYSTEM Center 2026 installations
• Contact SUBNET Solutions support at (403) 270-8885 or support@subnet.com for patch access

Workarounds

• CVE-2026-63017: monitor user activity records and disable Client Access Server users' access to browser F12 Developer Tools
• CVE-2026-63774: disable user access to the report designer

Longer-term hardening

• Keep control system networks off the public internet, behind firewalls, and isolated from business networks
• Use updated VPNs for remote access and assess connected devices
• Review and minimize low-privileged accounts with access to PowerSYSTEM Center
• Assess operational impact before making changes and follow internal incident response procedures; report suspected malicious activity to CISA

Affected and fixed versions

• SUBNET Solutions Inc. — PowerSYSTEM Center 2020
  Vulnerable versions: <= 5.29.x
  Fixed in: 2020 Update 30
• SUBNET Solutions Inc. — PowerSYSTEM Center 2024
  Vulnerable versions: 6.0.x through 6.2.x
  Fixed in: Upgrade to PowerSYSTEM Center 2026 Update 1.1
• SUBNET Solutions Inc. — PowerSYSTEM Center 2026
  Vulnerable versions: 7.0.x through 7.1.x
  Fixed in: 2026 Update 1.1

Timeline

• 2026-11-03 CISA states no known public exploitation of either vulnerability and that they are not remotely exploitable.
• 2026-11-03 CISA publishes the CSAF machine-readable advisory icsa-26-307-01.json in the cisagov/CSAF repository.
• 2026-11-03 Fixes available at advisory release: 2020 Update 30, and 2026 Update 1.1 (upgrade target for 2024 and fix for 2026).
• 2026-11-03 CISA publishes ICSA-26-307-01 (Revision 1) for Subnet Solutions PowerSYSTEM Center covering CVE-2026-63017 and CVE-2026-63774; Subnet Solutions self-reported and Chinmay Patel of Digital Boundary Group is credited.
• 2026-11-06 SecurityOnline and Daily Security Review report on the advisory and the available patches.
• 2026-11-06 CVE records and NVD entries for CVE-2026-63017 and CVE-2026-63774 are published with CVSS v3.1 9.0 and CVSS v4.0 9.4.
• 2026-11-09 Cyber Security News publishes coverage of the two CVSS 9.0 flaws, prompting this threat record.

Sources cited

• CISA ICS Advisory ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center CISA · Government advisory · 2026-11-03
• OpenCVE: CVE-2026-63017 app.opencve.io · Advisory · 2026-11-06
• OpenCVE: CVE-2026-63774 app.opencve.io · Advisory · 2026-11-06
• CISA CSAF document icsa-26-307-01 GitHub · Code repository · 2026-11-03
• CISA Warns Two Critical 9.0 Flaws in PowerSYSTEM Center Allow Unauthorized Access and SQL Injection cybersecuritynews.com · News · 2026-11-09
• Subnet Solutions PowerSYSTEM Center flaws patched securityonline.info · News · 2026-11-06
• CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center dailysecurityreview.com · News · 2026-11-06

More in vulnerability

• LNbits Operators Urged to Shut Down Bitcoin Lightning Wallet Servers Amid Active Attacks via Extension Exploit
• CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218
• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux