# CVE-2026-63774

Authenticated SQL injection in PowerSYSTEM Center report designer

- Page: https://www.vulneraibility.com/cve/CVE-2026-63774
- CVSS: 9.4
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-89
- Published: 2026-11-06

## Affected versions

- Subnet Solutions PowerSYSTEM Center 2024: affected >= 6.0.x and <= 6.2.x; fixed in PowerSYSTEM Center 2026 Update 1.1
- Subnet Solutions PowerSYSTEM Center 2026: affected >= 7.0.x and <= 7.1.x; fixed in Update 1.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated SQL injection allows execution of unauthorized SQL commands, enabling data theft, manipulation, and potential OT disruption.

## Action

Immediate action required

## Recommendation

Restrict or disable report designer access, rotate creds, monitor logs, apply vendor patch when available

## References

- [other] https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01
- [other] https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.