CVE-2026-35504: Subnet Solutions PowerSYSTEM Center CRLF injection in email service

CVE-2026-35504 · Severity: high · CVSS 5.5 · Published 2026-05-12

Subnet Solutions PowerSYSTEM Center, a management platform used in the energy and manufacturing sectors, is affected by multiple security vulnerabilities. These flaws could allow an authorized user with low-level access to view sensitive administrative data, delete project groups, or manipulate email notifications. Exploitation could lead to unauthorized data exposure or disruption of critical infrastructure management operations.

Technologies: Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024, Subnet Solutions Inc. PowerSYSTEM Center 2026. Vendors: Subnet Solutions Inc..

Quick answers

Is CVE-2026-35504 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35504 being exploited in the wild.
How severe is CVE-2026-35504?
High severity, with a CVSS score of 5.5, published 12 May 2026.
Which products and versions are affected?
Subnet Solutions Inc. PowerSYSTEM Center 2020 <=5.28.x; Subnet Solutions Inc. PowerSYSTEM Center 2024 >=6.0.x, <=6.1.x, 6.0.x - 6.1.x; Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x.
Is there a fix for CVE-2026-35504?
A patch was published on 2026-05-12: Updates released for 2020, 2024, and 2026 versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35504 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-35504?
Check whether you run Subnet Solutions Inc. PowerSYSTEM Center 2020, Subnet Solutions Inc. PowerSYSTEM Center 2024 or Subnet Solutions Inc. PowerSYSTEM Center 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Subnet Solutions PowerSYSTEM Center is affected by several vulnerabilities including Incorrect Authorization (CWE-863) and CRLF Injection (CWE-93). Specifically, REST API endpoints for device account exports and device information fail to properly enforce administrative permissions, allowing low-privileged users to access restricted data. Additionally, a flaw in the device project groups feature allows unauthorized deletion of groups, and the email notification service is susceptible to CRLF injection when using SMTPS. These vulnerabilities are reachable via the adjacent network and require basic user authentication. Patches are available in PowerSYSTEM Center 2020 Update 29, 2024 Update 2, and 2026 GA Hotfix.

Affected products

  • Subnet Solutions Inc. PowerSYSTEM Center 2020 <=5.28.x
  • Subnet Solutions Inc. PowerSYSTEM Center 2024 >=6.0.x, <=6.1.x
  • Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x

Identifiers

  • CVE-2026-35504
  • CVE-2026-35555
  • CVE-2026-26289
  • CVE-2026-33570

Timeline

  • 2026-05-12: advisory: CISA published advisory ICSA-26-132-02
  • 2026-05-12: patched: Updates released for 2020, 2024, and 2026 versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.