Who Holds the Substation Keys? Two 9.0 Bugs in PowerSYSTEM Center

Amigos, I want to start with a correction, because I saw this one framed wrong in a few places. This week’s CISA advisory isn’t about SCADA. It isn’t about an EMS either. It’s about something that, in a lot of utilities, holds the keys to the substation.

On November 3, CISA published ICSA-26-307-01 for Subnet Solutions PowerSYSTEM Center. Two vulnerabilities, both rated Critical. No known public exploitation. Not exploitable remotely, per CISA. And I still think every utility running it should move this week.

Let me explain why both of those things are true at the same time.

What PowerSYSTEM Center actually is

Subnet Solutions is based in Calgary, Canada. PowerSYSTEM Center is its platform for managing substation devices, the intelligent electronic devices (IEDs) like relays, meters and RTUs from many different vendors.

Per Subnet’s own product pages, it handles:

Remote access and session management to those IEDs
Password management and credential rotation, aimed at NERC CIP compliance
Remote firmware updates
Configuration baselines and drift detection

Subnet markets it as a NERC CIP “Intermediate System for IED Access Control,” and says it can integrate with enterprise systems “like IBM MQ, SAP, or SCADA EMS/DMS systems.” So it can connect to SCADA. It is not SCADA.

Think of it this way. SCADA is the control room operator’s view of the grid. PowerSYSTEM Center is closer to the building manager’s office, the one with the master keyring, the maintenance logs and the authority to let a contractor into any room. You don’t flip breakers from there. But if somebody walks off with that keyring, mira, you have a problem.

CISA lists the affected sectors as Energy and Critical Manufacturing, deployed worldwide.

What the two bugs are

CVE-2026-63017 is an incorrect authorization flaw. CISA’s description: it “allows a low-privileged, authenticated user to access resources normally limited to administrators.” It affects PowerSYSTEM Center 2020 (5.29.x and earlier), 2024 (6.0.x through 6.2.x) and 2026 (7.0.x through 7.1.x).

CVE-2026-63774 is a SQL injection in the report designer. Per CISA, insufficient input validation “allows an authenticated user to execute unauthorized SQL commands.” This one affects only the 2024 and 2026 versions. The 2020 branch is not listed as affected.

Both score 9.0 under CVSS v3.1 and 9.4 under v4.0. Both are Critical.

Now, por favor, read the vectors before you panic. Both say AV:A, which means adjacent network, and PR:L, which means the attacker already needs a low-privileged login. CISA says plainly: “These vulnerabilities are not exploitable remotely.” It also says no known public exploitation specifically targeting them has been reported. Neither CVE is in CISA’s Known Exploited Vulnerabilities catalog as of the November 4 catalog release.

So this is not internet remote code execution. It’s not a blackout button. Nobody is attributing it to any threat actor.

The vulnerabilities were reported to CISA by Chinmay Patel of Digital Boundary Group, and by Subnet Solutions itself. Credit where it’s due.

Why “local only” still matters here

Here’s the part I care about.

Why does a 9.0 score hold up when you need a login and adjacency? Because the scoring says scope changes and the downstream impact is high. Translation: the damage doesn’t stay inside PowerSYSTEM Center.

Think about what this platform centralizes. IED passwords. Configuration baselines. Firmware update workflows. Trusted remote access paths into substations. That’s the whole point of the product, claro. You consolidate all of it in one place so you can manage it properly.

That also makes it a crown jewel. A low-privileged user who can reach admin-only resources on a credential and config store is a much bigger deal than the same flaw on, say, a lunch menu app.

And “authenticated plus adjacent” describes real people in real utilities: a contractor with a basic account, an insider, a compromised jump host, a flat OT LAN where too many machines can see the management server. We’ve spent years telling the industry that the management and access planes are where attackers like to live. This is one of those planes.

There’s a compliance angle too, familia. Subnet maps PowerSYSTEM Center to CIP-005-7 (electronic access through an Intermediate System), CIP-007-7 (system security and credentials) and CIP-010-4 (configuration change management). Whether your specific install is classified that way is your call with your compliance team. But if it is, an authorization gap in the tool that mediates IED access cuts right against the control it’s supposed to provide.

What to do about it

The fixes, per Subnet via CISA:

2020: apply Update 30
2024: upgrade to PowerSYSTEM Center 2026 Update 1.1
2026: apply 2026 Update 1.1

If you can’t patch yet, CISA relays three compensating controls from Subnet: monitor user activity records, disable the browser F12 Developer Tools for Client Access Server users (for the authorization issue), and disable user access to the report designer (for the SQL injection).

Beyond the patch, here’s what I’d do:

Find every instance and confirm the exact build. Know whether you’re on 2020, 2024 or 2026 and which range.
Shrink who can reach it. Only admin networks and your jump or Intermediate System path should have adjacency. Review contractor and vendor access into that zone.
Clean up accounts. Remove standing low-privilege accounts that don’t need access, and put MFA and least privilege on the ones that do.
Send logs to your SIEM. Alert on privilege use, report designer use and unusual bulk password or firmware jobs.
Have a rotation plan. If you can’t rule out abuse before you patched, rotate IED credentials and re-verify configuration baselines.

Bottom line

PowerSYSTEM Center isn’t SCADA. It’s the substation keyring, and that’s exactly why its bugs matter.
Both flaws need a login and adjacent access, and CISA reports no known exploitation. That’s your window to patch calmly, not a reason to wait.
Treat any platform that centralizes IED passwords, configs and remote access as a crown jewel: limit who can reach it, watch it and patch it first.

Stay sharp out there.

Javier