CVE-2026-63017
CriticalCVSS 9.0Summary
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
Risk Assessment
This may enable privilege escalation and access to administrative functions by regular users. It risks unauthorized configuration changes or data disclosure.
Recommendation
Install the vendor fix that corrects the authorization check. Also review accounts and permissions in the system.
Other vulnerabilities in PowerSYSTEM Center
See all- CVE-2026-63774Critical
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
- CVE-2026-35555Medium
The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
- CVE-2026-33570Medium
The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.
- CVE-2026-35504Medium
The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.
Original NVD description (English source)
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS