CVE-2026-63774: Subnet Solutions PowerSYSTEM Center SQL Injection

Published Nov 6, 2026

Updated

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Subnet Solutions PowerSYSTEM Center to a version that resolves this vulnerability.
Fixed in 2026 Update 1.1

Event History

Nov 6, 2026

CVE Published

via MITRE·12:05 AM

Data Sourced

via MITRE·12:05 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be authenticated to PowerSYSTEM Center and able to use the report designer. No user interaction is required.

What level of access could exploitation provide?

Successful exploitation allows unauthorized SQL commands to be executed. The reported impact includes high confidentiality, integrity, and availability impact, with scope changed.

Is remote network access required?

The attack vector is adjacent network, meaning the attacker must have access to an adjacent network rather than requiring purely local access.

CVE-2026-63774: Subnet Solutions PowerSYSTEM Center SQL Injection

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access could exploitation provide?

Is remote network access required?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access could exploitation provide?

Is remote network access required?