Which versions of PowerSYSTEM Center are affected by CVE-2026-26289?

SUBNET Solutions PowerSYSTEM Center versions 2020, 2024, and 2026 contain an authorization flaw that allows authenticated operators with basic permissions to access sensitive administrative…

How to fix or mitigate CVE-2026-26289?

Within 24 hours, identify all instances of PowerSYSTEM Center running versions 2020, 2024, or 2026 and audit which low-privilege users have API access; prepare network segmentation controls to restrict the device-account-export REST API endpoint to administrators only. Within 7 days, implement firewall or reverse proxy rules blocking device-account-export calls from non-administrative accounts and IP ranges; review API access logs for unauthorized device-account-export requests in the past 90 days to detect prior exploitation; notify all low-privilege operators of temporary API restrictions. Within 30 days, contact SUBNET Solutions directly to obtain an estimated patch release date for versions 2020, 2024, and 2026; deploy permanent API gateway or WAF-based filtering as a backup control; develop a patch deployment schedule once vendor releases fixes and communicate the deployment timeline to operational teams.

PowerSYSTEM Center CVE-2026-26289

Q: What is the CVSS score of CVE-2026-26289?

CVE-2026-26289 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29828 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 icscert

GHSA-cj84-4hc2-frh6

Authentication Bypass Powersystem Center 2020 Powersystem Center 2024 Powersystem Center 2026 Subnet Solutions

8.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.4 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.7 MEDIUM

Requires an authenticated low-privilege account on the adjacent management network (PR:L, AV:A); impact is sensitive-data exposure only, so C:H with I:N/A:N.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:20 vuln.today

CVSS changed

May 12, 2026 - 22:22 NVD

8.2 (HIGH) 8.4 (HIGH)

CVE Published

May 12, 2026 - 21:02 nvd

HIGH 8.4

DescriptionCVE.org

PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.

AnalysisAI

Information disclosure in SUBNET Solutions PowerSYSTEM Center (2020, 2024, and 2026) lets an authenticated user with only limited permissions call the REST API device-account-export endpoint to retrieve sensitive data that should be restricted to administrators. The flaw is a broken authorization (CWE-863) check, so a low-privilege operator can escalate their effective data access without any administrative role. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 6th percentile), consistent with CISA's SSVC rating of 'Exploitation: none.'

Technical ContextAI

PowerSYSTEM Center is SUBNET Solutions' operational-technology (OT/ICS) management platform used in electric-utility and substation automation environments to centrally manage intelligent electronic devices and their account credentials. The vulnerability lives in a REST API endpoint that exports device account information; the endpoint fails to enforce that the caller holds administrative privileges before returning the data. This is a classic CWE-863 (Incorrect Authorization) issue: the authentication layer correctly identifies the user, but the authorization layer does not gate the sensitive export behind the required admin role, allowing horizontal/vertical exposure of protected data. Affected CPEs are cpe:2.3:a:subnet_solutions:powersystem_center_2020, :powersystem_center_2024, and :powersystem_center_2026.

RemediationAI

No exact vendor-released fix version is present in the provided data, so consult the CISA advisory ICSA-26-132-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02) and the corresponding CSAF document for the SUBNET Solutions-supplied fixed builds and upgrade to the patched release for your product family (2020 5.x, 2024 6.x, or 2026 7.x) once identified. Until patched, apply compensating controls appropriate to OT networks: tightly restrict which accounts can reach the PowerSYSTEM Center REST API and, if feasible, block or firewall access to the device-account-export endpoint for non-administrative users (trade-off: may break legitimate low-privilege workflows that rely on that API); enforce least-privilege by reviewing and minimizing the number of low-permission accounts; and place the management interface on an isolated, monitored network segment consistent with IEC 62443/ICS segmentation guidance to reduce the Adjacent attack surface (trade-off: added operational friction for remote administration). Monitor API access logs for unexpected export calls by non-admin users.