CVE-2026-35555
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
Risk Assessment
A low-privileged user can delete project groups, leading to loss of configuration data and disruption of device management.
Recommendation
Update PowerSYSTEM Center to a patched version and review user permissions for project group operations.
Other vulnerabilities in PowerSYSTEM Center
See all- CVE-2026-33570Medium
The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.
- CVE-2026-35504Medium
The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.
Original NVD description (English source)
PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS