CVE-2026-63774
CriticalCVSS 9.0Summary
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
Risk Assessment
An authenticated user could access or modify data beyond their granted permissions. This poses a risk to data confidentiality and integrity in the system.
Recommendation
Apply the vendor fix that implements proper input validation in the report designer. Additionally, restrict privileges of accounts using this feature.
Other vulnerabilities in PowerSYSTEM Center
See all- CVE-2026-63017Critical
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
- CVE-2026-35555Medium
The device project groups feature in PowerSYSTEM Center allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.
- CVE-2026-33570Medium
The PowerSYSTEM Center REST API endpoint for devices allows a low-privilege authenticated user to access information normally limited by operational permissions.
- CVE-2026-35504Medium
The PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication. The vulnerability may allow manipulation of email message headers.
Original NVD description (English source)
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS