Our takeCISA reports active exploitation of SQL injection and access-control flaws in Subnet Solutions PowerSYSTEM Center (CVE-2026-63017, CVE-2026-63774). Patch affected versions immediately if you run industrial control software.Security Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:CISA reports active exploitation of SQL injection and access-control flaws in Subnet Solutions PowerSYSTEM Center (affecting 2020 <=5.29.x and 2024 6.0.x–6.2.x). Patch immediately or isolate affected systems if you run industrial power-management software.
What this means for you — Lean IT orgs:If you run Subnet Solutions PowerSYSTEM Center for power or industrial control, update it right away — these flaws let attackers run unauthorized database commands. Most small teams should check with your equipment vendor or integrator.
What this means for you — MSP:CISA reports active exploitation of SQL injection and access-control issues in Subnet Solutions PowerSYSTEM Center (2020 <=5.29.x, 2024 6.0–6.2.x). Audit every client running industrial power software and push the vendor patches or network isolation now.
What this means for you — Researcher:CISA reports active exploitation of CVE-2026-63017 (and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center. Affected: 2020 <=5.29.x and 2024 >=6.0.x <=6.2.x. Successful exploitation allows unauthorized SQL commands and resource access.