Subnet Solutions PowerSYSTEM Center SQL Injection

Summary

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Remediation

1. Inventory every Subnet Solutions PowerSYSTEM Center 2024 deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json
• Referencehttps://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01