Subnet Solutions PowerSYSTEM Center

Summary

Vulnerabilities 4

• High 8.2
  CVE-2026-26289

  Subnet Solutions PowerSYSTEM Center Incorrect Authorization

  PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.

  Subnet Solutions PowerSYSTEM Center 2020 PowerSYSTEM Center 2024 PowerSYSTEM Center 2026
  May 12, 2026
• Medium 6.3
  CVE-2026-35555

  Subnet Solutions PowerSYSTEM Center Incorrect Authorization

  PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

  Subnet Solutions PowerSYSTEM Center 2026 PowerSYSTEM Center 2024
  May 12, 2026
• Medium 5.7
  CVE-2026-33570

  Subnet Solutions PowerSYSTEM Center Incorrect Authorization

  PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.

  Subnet Solutions PowerSYSTEM Center 2020
  May 12, 2026
• Medium 5.5
  CVE-2026-35504

  Subnet Solutions PowerSYSTEM Center CRLF injection

  PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication.

  Subnet Solutions PowerSYSTEM Center 2020 PowerSYSTEM Center 2024 PowerSYSTEM Center 2026
  May 12, 2026

Revision history

1. 2026-05-12 #1

   Initial Publication

References

• ICSA Advisory ICSA-26-132-02 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
• Recommended Practices
  https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b
• Recommended Practices
  https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing
• Recommended Practices
  https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks