# CISA ICSA-26-307-01: Critical Authorization Bypass (CVE-2026-63017) and SQL Injection (CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center

> CISA advisory ICSA-26-307-01 (released 2026-11-03) describes two CVSS v3.1 9.0 flaws in Subnet Solutions' PowerSYSTEM Center: an incorrect authorization flaw (CWE-863) that lets a low-privileged authenticated user reach administrator-only resources, and a SQL injection (CWE-89) in the report designer that lets an authenticated user run unauthorized SQL commands. CISA reports no known public exploitation, and patches are available.

- **Published:** 2026-11-09T23:50:44Z
- **Last reviewed:** 2026-11-09T23:50:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5604
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5604.png
- **ID:** TL-2026-5604
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-63017, CVE-2026-63774

## Description

PowerSYSTEM Center is grid-equipment management software from SUBNET Solutions Inc. (Canada) used in the Energy and Critical Manufacturing sectors worldwide. CISA published ICSA-26-307-01 on 2026-11-03 (Revision 1, initial publication). The CVE records and NVD entries for both CVEs were published on 2026-11-06.

CVE-2026-63017 (CWE-863, Incorrect Authorization): a low-privileged, authenticated user can access resources normally limited to administrators. Secondary reporting says a user on an adjacent network can view administrator data and open files meant for root, and one outlet suggests this may include configuration data and credentials; the CISA advisory text itself only states access to administrator-only resources. The interim mitigation of restricting Client Access Server users from browser F12 Developer Tools suggests client-side tooling can be used to reach the restricted functionality, but the advisory does not describe the mechanism in more detail.

CVE-2026-63774 (CWE-89, SQL Injection): insufficient input validation in the PowerSYSTEM Center report designer lets an authenticated user execute unauthorized SQL commands. Secondary reporting says this includes arbitrary database queries and modification of stored data. The impact is database command execution; OS-level code execution is not confirmed by any source.

Both flaws carry the same scoring: CVSS v3.1 9.0 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 9.4 (AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The attack vector is adjacent (not network), complexity is low, privileges required are low, and no user interaction is needed. CISA states the flaws are not exploitable remotely; that statement sits alongside an AV:A vector, so defenders should treat any adjacent-network position or compromised low-privilege account as sufficient to reach exploitation. Affected: PowerSYSTEM Center 2020 up to 5.29.x, 2024 6.0.x to 6.2.x, and 2026 7.0.x to 7.1.x for CVE-2026-63017. For CVE-2026-63774, OpenCVE and the hunt data list the 2024 and 2026 ranges, while CISA's table lists all three lines; the advisory gives no remediation text for CVE-2026-63774 on 2020, so treat the 2020 line as potentially exposed until the vendor confirms.

Fixes: 2020 users upgrade to 2020 Update 30; 2024 users upgrade to PowerSYSTEM Center 2026 Update 1.1; 2026 users apply Update 1.1. Where upgrading is not possible, CISA recommends monitoring user activity records and disabling Client Access Server users' access to browser F12 Developer Tools (CVE-2026-63017) and disabling user access to the report designer (CVE-2026-63774). Credit goes to Chinmay Patel of Digital Boundary Group and to Subnet Solutions (self-reported). No public PoC, IOCs, threat actor attribution, or CISA KEV listing were identified. No network IOCs exist, so no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [SPL]** (`TL-2026-5604-SPL-002`)

Flags successful requests to administrative, credential and configuration PowerSYSTEM Center URIs by authenticated accounts missing from the administrator list, the CVE-2026-63017 hunt hypothesis from TL-2026-5604 (low-privileged account accessing administrator-only resources). Covers privilege escalation via incorrect authorization, collection from information repositories, and exposure of stored credentials or configuration files; adds a referer-less direct API call counter as a proxy for browser developer-tools replay. The F12 Developer Tools abuse path itself is client-side and not visible in server logs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548, T1078, T1213, T1552, T1552.001
- **Data sources:** iis:ms:iis:auto (index=iis), W3CIISLog, sigma:webserver (IIS W3C), lookup:powersystem_admin_users.csv, watchlist:PowerSYSTEMAdmins
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=iis sourcetype="ms:iis:auto" earliest=-24h sc_status IN (200,201,204,302) (cs_uri_stem="*/admin*" OR cs_uri_stem="*/administration*" OR cs_uri_stem="*/api/admin*" OR cs_uri_stem="*/usermanagement*" OR cs_uri_stem="*/configuration*" OR cs_uri_stem="*credential*" OR cs_uri_stem="*web.config*" OR cs_uri_stem="*appsettings*" OR cs_uri_stem="*connectionstring*")
| where cs_username!="-" AND isnotnull(cs_username)
| lookup powersystem_admin_users.csv cs_username OUTPUT is_admin
| where isnull(is_admin)
| eval referer=coalesce(cs_referer,cs_Referer,"-")
| eval f_cred=if(match(lower(cs_uri_stem),"credential|password|secret"),1,0), f_cfg=if(match(lower(cs_uri_stem),"web[.]config|appsettings|connectionstring"),1,0), f_direct_api=if(like(lower(cs_uri_stem),"%/api/%") AND referer="-",1,0)
| eval src_class=if(cidrmatch("10.0.0.0/8",c_ip) OR cidrmatch("172.16.0.0/12",c_ip) OR cidrmatch("192.168.0.0/16",c_ip),"private","non_private")
| stats count dc(cs_uri_stem) as distinct_admin_uris sum(f_cred) as credential_uri_ct sum(f_cfg) as config_uri_ct sum(f_direct_api) as referer_less_api_ct values(cs_uri_stem) as uris min(_time) as first_seen max(_time) as last_seen by cs_username c_ip src_class host
| eval threat="TL-2026-5604 CVE-2026-63017 PowerSYSTEM Center admin-only resource access by non-admin"
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let adminUsers = _GetWatchlist("PowerSYSTEMAdmins") | project csUserName = tostring(SearchKey);
W3CIISLog
| where TimeGenerated > ago(24h)
| where scStatus in ("200", "201", "204", "302")
| where csUserName != "-" and isnotempty(csUserName)
| where csUriStem has_any ("/admin", "/administration", "/api/admin", "/usermanagement", "/configuration", "credential", "web.config", "appsettings", "connectionstring")
| join kind=leftanti adminUsers on csUserName
| extend FCred = tolower(csUriStem) matches regex @"credential|password|secret",
         FCfg = tolower(csUriStem) matches regex @"web[.]config|appsettings|connectionstring",
         FDirectApi = tolower(csUriStem) contains "/api/" and (isempty(csReferer) or csReferer == "-"),
         SrcClass = iff(ipv4_is_private(cIP), "private", "non_private")
| summarize Hits = count(), DistinctUris = dcount(csUriStem), CredentialUriCt = countif(FCred), ConfigUriCt = countif(FCfg), RefererLessApiCt = countif(FDirectApi), Uris = make_set(csUriStem, 25), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by csUserName, cIP, SrcClass, Computer
| project FirstSeen, LastSeen, csUserName, cIP, SrcClass, Computer, Hits, DistinctUris, CredentialUriCt, ConfigUriCt, RefererLessApiCt, Uris
```

### Sigma

```yaml
title: PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017)
id: 3c9d8e41-6a2b-4f17-b5d0-8e7a1c2d9b02
status: experimental
description: Detects successful requests to administrative or credential/configuration PowerSYSTEM Center URIs by accounts that are not known administrators, the hunt hypothesis for CVE-2026-63017 (TL-2026-5604). Replace the example filter with your real administrator accounts. The F12 Developer Tools abuse path is client-side and not visible in server logs.
references:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
    - https://nvd.nist.gov/vuln/detail/CVE-2026-63017
author: Threadlinqs Team
date: 2026-11-09
tags:
    - attack.privilege_escalation
    - attack.t1548
    - attack.initial_access
    - attack.t1078
    - attack.collection
    - attack.t1213
    - attack.credential_access
    - attack.t1552
    - attack.t1552.001
    - cve.2026.63017
logsource:
    category: webserver
detection:
    selection_admin_uri:
        cs-uri-stem|contains:
            - '/admin'
            - '/administration'
            - '/usermanagement'
            - '/configuration'
    selection_cred_cfg_uri:
        cs-uri-stem|contains:
            - 'credential'
            - 'web.config'
            - 'appsettings'
            - 'connectionstring'
    selection_status:
        sc-status:
            - 200
            - 201
            - 204
    filter_known_admins:
        cs-username:
            - 'administrator'
            - 'psc_admin'
    condition: (selection_admin_uri or selection_cred_cfg_uri) and selection_status and not filter_known_admins
falsepositives:
    - Operators or engineers with legitimate delegated administrative duties not in the filter list
    - Service accounts polling configuration endpoints
level: high

```

**Known false positives:**

- Delegated operators with legitimate administrative duties missing from the admin list
- Service accounts polling configuration endpoints

**Tuning notes:** Populate powersystem_admin_users.csv (column cs_username, is_admin=1) and the PowerSYSTEMAdmins Sentinel watchlist (SearchKey = username) before enabling, otherwise every admin URI hit alerts; replace the example filter_known_admins values in the Sigma rule. Replace URI patterns with real admin paths observed in your logs. Correlate with the application's own user activity records, which CISA recommends monitoring.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [KQL] (locked: unlock with TL Creds)
- PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [KQL] (locked: unlock with TL Creds)
- PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [KQL] (locked: unlock with TL Creds)
- PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [Sigma] (locked: unlock with TL Creds)
- PowerSYSTEM Center Admin-Only Resource Access by Non-Admin Account (CVE-2026-63017) [Sigma] (locked: unlock with TL Creds)
- PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [Sigma] (locked: unlock with TL Creds)
- PowerSYSTEM Center Report Designer SQL Injection (CVE-2026-63774) [SPL] (locked: unlock with TL Creds)
- PowerSYSTEM Center Database Abuse and Stored Data Manipulation (CVE-2026-63774) [SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA ICS Advisory ICSA-26-307-01: Subnet Solutions PowerSYSTEM Center](https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01)
- [CISA CSAF document icsa-26-307-01](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json)
- [OpenCVE: CVE-2026-63017](https://app.opencve.io/cve/CVE-2026-63017)
- [OpenCVE: CVE-2026-63774](https://app.opencve.io/cve/CVE-2026-63774)
- [CISA Warns Two Critical 9.0 Flaws in PowerSYSTEM Center Allow Unauthorized Access and SQL Injection](https://cybersecuritynews.com/cisa-warns-critical-flaws-in-powersystem-center/)
- [Subnet Solutions PowerSYSTEM Center flaws patched](https://securityonline.info/subnet-solutions-powersystem-center-flaws-patched/)
- [CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center](https://dailysecurityreview.com/?p=45480)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5604