Which versions of PowerSYSTEM Center are affected by CVE-2026-35555?

Subnet Solutions PowerSYSTEM Center (versions 6.0.x-7.0.x) contains an authorization flaw allowing internal, low-privileged users to delete critical device project groups, compromising IT asset…

How to fix or mitigate CVE-2026-35555?

Within 24 hours, audit access logs across all affected PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) instances to confirm whether low-privileged users have deleted device project groups, and document any suspicious activity. Within 7 days, restrict project group deletion functionality to administrative accounts only through role-based access controls, enable detailed audit logging on all project group operations, and implement real-time alerting for any deletion attempts by non-administrative users. Within 30 days, contact Subnet Solutions regarding patch availability and timelines for versions beyond 7.0.x, and establish a permanent access control baseline that prevents low-privileged users from modifying critical device inventory structures.

PowerSYSTEM Center CVE-2026-35555

Q: What is the CVSS score of CVE-2026-35555?

CVE-2026-35555 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29831 HIGH

Incorrect Authorization (CWE-863)

2026-05-12 icscert

GHSA-m3ph-wv95-837r

Authentication Bypass Powersystem Center 2024 Powersystem Center 2026 Subnet Solutions

7.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Authenticated low-privilege user (PR:L) on an adjacent network (AV:A) deletes project groups, giving high integrity impact and low availability impact with no confidentiality loss.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:23 vuln.today

Severity Changed

May 12, 2026 - 22:22 NVD

MEDIUM HIGH

CVSS changed

May 12, 2026 - 22:22 NVD

6.3 (MEDIUM) 7.0 (HIGH)

CVE Published

May 12, 2026 - 20:48 nvd

HIGH 7.0

DescriptionCVE.org

PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

AnalysisAI

Improper authorization in Subnet Solutions PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) lets an authenticated, low-privileged user delete device project groups they should not be able to remove, causing integrity loss to the managed device inventory. The flaw stems from missing permission enforcement on the project-group deletion function rather than an authentication bypass at the perimeter. There is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none.'

Technical ContextAI

PowerSYSTEM Center is a Subnet Solutions platform used in utility/OT environments to manage, poll, and organize field devices (e.g., IEDs, RTUs) into logical 'project groups.' The root cause is CWE-863 (Incorrect Authorization): the application authenticates the user and grants a session, but the server-side handler for deleting a project group fails to verify that the acting account holds sufficient privileges for that operation. As a result, a permission check that should gate a destructive administrative action is either absent or evaluated incorrectly, allowing a limited-role account to invoke functionality reserved for higher-privileged operators. Affected builds are enumerated in the CPE data as cpe:2.3:a:subnet_solutions:powersystem_center_2024 and cpe:2.3:a:subnet_solutions:powersystem_center_2026.

RemediationAI

Follow the vendor and CISA guidance in ICS advisory ICSA-26-132-02 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02); the provided data does not include an exact fixed build number, so no vendor-released patch version is independently confirmed from this input - treat 'upgrade to the vendor-designated fixed release for PowerSYSTEM Center 2024 6.1.x and 2026 7.0.x' as the primary action and obtain the precise version directly from Subnet Solutions. Because the flaw is authorization-based, effective compensating controls until patching include tightening role/permission assignments so only trusted operators hold accounts capable of managing project groups, auditing and reducing low-privilege accounts, and restricting network reachability of the PowerSYSTEM Center management interface to a trusted OT management VLAN or jump host (limiting the AV:A adjacent-access precondition); side effects are added administrative overhead and possible workflow friction for legitimate limited-role users. Enable and monitor audit logging for project-group deletion events so unauthorized removals can be detected and restored from backup, and ensure current backups of project-group configuration exist to recover from any integrity loss.