# CVE-2026-63017

Auth bypass in PowerSYSTEM Center allows low-privileged users to gain admin access

- Page: https://www.vulneraibility.com/cve/CVE-2026-63017
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-863
- Published: 2026-11-06

## Affected versions

- Subnet Solutions PowerSYSTEM Center 2020: affected <= 5.29.x; fixed in Update 30
- Subnet Solutions PowerSYSTEM Center 2024: affected >= 6.0.x and <= 6.2.x; fixed in PowerSYSTEM Center 2026 Update 1.1
- Subnet Solutions PowerSYSTEM Center 2026: affected >= 7.0.x and <= 7.1.x; fixed in Update 1.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated low-privilege users can escalate to administrator, modify configurations, access sensitive OT controls, and potentially disrupt power/industrial operations.

## Action

Immediate action required

## Recommendation

Restrict access, apply vendor mitigations, monitor logs, deploy patch when released

## References

- [other] https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
- [other] https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.