Is CVE-2026-26289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26289 being exploited in the wild.

How severe is CVE-2026-26289?

High severity, with a CVSS score of 8.2, published 12 May 2026.

Which products and versions are affected?

Subnet Solutions Inc. PowerSYSTEM Center 2020 >=5.8.x, =6.0.x, <=6.1.x; Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x.

Is there a fix for CVE-2026-26289?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-26289 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-26289?

Check whether you run Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024 or Subnet Solutions Inc. PowerSYSTEM Center 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26289: Subnet Solutions PowerSYSTEM Center incorrect authorization in REST API

Q: Is there a fix for CVE-2026-26289?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-26289 attacked?

It is attacked from the adjacent network, in a network appliance.

Q: Am I affected by CVE-2026-26289?

Check whether you run Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024 or Subnet Solutions Inc. PowerSYSTEM Center 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26289 · Severity: high · CVSS 8.2 · Published 2026-05-12

Subnet Solutions PowerSYSTEM Center, a management platform used in critical infrastructure like energy and manufacturing, contains a security flaw in its device account export feature. This flaw allows a user with low-level access to export sensitive administrative information they should not be able to see. This could lead to unauthorized access to critical system accounts and potential disruption of industrial operations.

Technologies: Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024, Subnet Solutions Inc. PowerSYSTEM Center 2026. Vendors: Subnet Solutions Inc..

Quick answers

Is CVE-2026-26289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26289 being exploited in the wild.
How severe is CVE-2026-26289?: High severity, with a CVSS score of 8.2, published 12 May 2026.
Which products and versions are affected?: Subnet Solutions Inc. PowerSYSTEM Center 2020 >=5.8.x, <=5.28.x; Subnet Solutions Inc. PowerSYSTEM Center 2024 >=6.0.x, <=6.1.x; Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x.
Is there a fix for CVE-2026-26289?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-26289 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-26289?: Check whether you run Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024 or Subnet Solutions Inc. PowerSYSTEM Center 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the REST API endpoint for device account export within Subnet Solutions PowerSYSTEM Center. The root cause is a failure to properly enforce administrative permission checks on the export function. An authenticated attacker with limited permissions can reach this endpoint via an adjacent network to expose sensitive information normally restricted to administrators. This vulnerability affects PowerSYSTEM Center 2020, 2024, and 2026 versions. Subnet Solutions has released updates (PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix) to remediate the issue.

Affected products

Subnet Solutions Inc. PowerSYSTEM Center 2020 >=5.8.x, <=5.28.x
Subnet Solutions Inc. PowerSYSTEM Center 2024 >=6.0.x, <=6.1.x
Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x

Timeline

2026-05-12: disclosed
2026-05-12: advisory: CISA Advisory ICSA-26-132-02 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.