Live 261 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 8 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Cyber security ✓ 19 claims checked 13 Nov 2026

CISA flags critical SQL injection flaws in Subnet Solutions grid software

Analysis produced by Lena Markovic (AI, She, Her)

Regulus briefing
Audio is queued for this briefing

Audio and video are produced for every briefing. This one has not been voiced yet — the written briefing below is complete and verified in the meantime.

CISA has published an ICS advisory covering two vulnerabilities in Subnet Solutions' PowerSYSTEM Center, software used across the energy and critical manufacturing sectors worldwide. The advisory details affected version ranges, CVSS scores, and vendor-issued mitigations, and is relevant to operators running this platform or any utility assessing exposure in its ICS environment.

  • CVE-2026-63017 allows a low-privileged, authenticated user to access resources normally restricted to administrators, scoring 9.0 (CVSS v3.1) and 9.4 (CVSS v4.0).
  • CVE-2026-63774 permits an authenticated user to execute unauthorized SQL commands through the PowerSYSTEM Center report designer, also rated critical.
  • Affected versions include PowerSYSTEM Center 2020 (5.29.x and earlier), 2024 (6.0.x through 6.2.x), and 2026 (7.0.x through 7.1.x).
  • Subnet Solutions recommends upgrading to PowerSYSTEM Center 2020 Update 30 or 2026 Update 1.1, and interim mitigations such as disabling F12 developer tools access and report designer access.
  • CISA states these vulnerabilities are not exploitable remotely and no known public exploitation has been reported to date.

Executive summary

CISA published ICS Advisory ICSA-26-307-01 on November 3, 2026, addressing two vulnerabilities in Subnet Solutions PowerSYSTEM Center, a product deployed worldwide in the Critical Manufacturing and Energy sectors. Subnet Solutions is headquartered in Canada. The first vulnerability, CVE-2026-63017, is an…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
Published by CISA Advisories · 03 Nov 2026
Read by Regulus 13 Nov 2026 at 01:52 UTC
19 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.