Threat video1:00
CVE-2026-63017 PowerSYSTEM Bypass: Detection & IOCs
A low-privileged user can reach admin-only resources in PowerSYSTEM Center (CVE-2026-63017). Get 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-63017 PowerSYSTEM Bypass: Detection & IOCs →
Chapters
- 0:00The hookGrid software flaws: CVSS 9.0, patches available.
- 0:05The storyA low-privileged user can reach admin-only resources.
- 0:13Attack pathFirst, an authenticated low-privileged user.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise5 indicators to hunt: 5 package names.
- 0:39MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Upgrade PowerSYSTEM Center 2020 to Update 30.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Grid software flaws: CVSS 9.0, patches available.
0:06A low-privileged user can reach admin-only resources.
0:09CISA reports no known public exploitation.
0:13First, an authenticated low-privileged user.
0:16Incorrect authorization opens admin-only resources.
0:20SQL injection flaw allows unauthorized SQL commands.
0:25Fixes were available at release.
0:29No threat actor is attributed. Confidence: low.
0:345 indicators to hunt: 5 package names.
0:396 ATT&CK techniques, from initial access to impact.
0:444 steps now: Upgrade PowerSYSTEM Center 2020 to Update 30.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.