CVE-2026-35504
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.
Risk Assessment
CRLF injection may allow an attacker to add or modify email headers, potentially leading to phishing or sender spoofing. The risk affects email communication integrity.
Recommendation
Apply available PowerSYSTEM Center updates and verify input validation in the notification service. Monitor for unusual headers in outgoing messages.
Other vulnerabilities in PowerSYSTEM Center
See all- CVE-2026-35555Medium
The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
- CVE-2026-33570Medium
The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.
Original NVD description (English source)
PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS