Users of Subnet Solutions' PowerSYSTEM Center should update to PowerSYSTEM Center 2026 Update 1.1, which fixes SQL injection vulnerabilities scored as critical.
The advisory, published November 3, lists PowerSYSTEM Center 2020 as affected, with builds in the 6.0.x and 7.0.x lines and up to 7.1.x. The flaws fall under CWE-89, the category for SQL injection. That is a bug in which software passes attacker-supplied text into a database query without cleaning it, so the database runs commands it was never meant to. Successful exploitation could let an attacker run unauthorized SQL commands and reach resources they should not see.
The scores are high: 9.0 under CVSS 3.1 and 9.4 under CVSS 4.0, both rated critical. The vector strings give the shape of the risk. The attacker needs access to an adjacent network, meaning the same local segment rather than the open internet, and only low privileges, with no user interaction. The advisory also notes a changed scope, so damage can spill beyond the vulnerable component. The advisory states the flaws are not exploitable remotely and that no public exploitation has been reported.
For anyone who cannot upgrade right away, Subnet Solutions recommends disabling user access to the report designer. Help is available from its System Integration team or customer support at (403) 270-8885 or support@subnet.com. Chinmay Patel of Digital Boundary Group reported the flaws, as did Subnet Solutions itself.
The critical rating rests on a specific condition: someone already inside the network with a working account. In industrial environments, that makes the quality of network segmentation and account hygiene the real measure of exposure. The advisory's standard guidance, keeping control systems off the internet and behind firewalls, applies directly. A 9.4 reached through a low-privilege login is a different problem from a 9.4 reachable by anyone.