Is CVE-2026-33570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33570 being exploited in the wild.

How severe is CVE-2026-33570?

Medium severity, with a CVSS score of 5.7, published 12 May 2026.

Which products and versions are affected?

Subnet Solutions Inc. PowerSYSTEM Center >=5.11.x, <=5.28.x.

Is there a fix for CVE-2026-33570?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33570 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-33570?

Check whether you run Subnet Solutions Inc. PowerSYSTEM Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33570: Subnet Solutions PowerSYSTEM Center incorrect authorization in REST API

Q: Is there a fix for CVE-2026-33570?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-33570 attacked?

It is attacked from the adjacent network, in a network appliance.

Q: Am I affected by CVE-2026-33570?

Check whether you run Subnet Solutions Inc. PowerSYSTEM Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33570 · Severity: medium · CVSS 5.7 · Published 2026-05-12

Subnet Solutions PowerSYSTEM Center, a management platform used in critical infrastructure and energy sectors, contains a security flaw in its web interface. An authorized user with low-level access can bypass intended restrictions to view sensitive device information that should only be available to higher-level operators. This could lead to the unauthorized exposure of operational data or system configurations.

Vendors: Subnet Solutions Inc..

Quick answers

Is CVE-2026-33570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33570 being exploited in the wild.
How severe is CVE-2026-33570?: Medium severity, with a CVSS score of 5.7, published 12 May 2026.
Which products and versions are affected?: Subnet Solutions Inc. PowerSYSTEM Center >=5.11.x, <=5.28.x.
Is there a fix for CVE-2026-33570?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33570 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-33570?: Check whether you run Subnet Solutions Inc. PowerSYSTEM Center at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the REST API endpoint for devices within Subnet Solutions PowerSYSTEM Center. The flaw allows an authenticated attacker with low-level privileges to bypass operational permission checks and retrieve sensitive device information. The attack vector is restricted to the adjacent network (AV:A), meaning the attacker must have access to the local or management network where the system resides. Successful exploitation results in a loss of confidentiality regarding device data. The issue is addressed in PowerSYSTEM Center 2020 Update 29, 2024 Update 2, and 2026 GA Hotfix.

Affected products

Subnet Solutions Inc. PowerSYSTEM Center 2020 >=5.11.x, <=5.28.x

Timeline

2026-05-12: advisory: CISA ICSA-26-132-02 published
2026-05-12: disclosed: CVE-2026-33570 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.