# CVE-2026-35555: Subnet Solutions PowerSYSTEM Center incorrect authorization in project groups

Source: https://junglewise.ai/threats/cve-2026-35555-subnet-solutions-powersystem-center-incorrect-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-35555 · Severity: medium · CVSS 6.3 · Published 2026-05-12

Subnet Solutions PowerSYSTEM Center, a management platform used in the energy and manufacturing sectors, contains a security flaw in its project group management feature. An authenticated user with low-level permissions can delete device project groups that they should not have the authority to modify. This could lead to operational disruptions or the loss of organized configuration data within the system.

Technologies: [Subnet Solutions Inc. PowerSYSTEM Center 2024](https://junglewise.ai/threats/technologies/powersystem-center-2024), [Subnet Solutions Inc. PowerSYSTEM Center 2026](https://junglewise.ai/threats/technologies/powersystem-center-2026). Vendors: [Subnet Solutions Inc.](https://junglewise.ai/threats/vendors/subnet-solutions-inc).

## Quick answers

**Is CVE-2026-35555 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35555 being exploited in the wild.

**How severe is CVE-2026-35555?** Medium severity, with a CVSS score of 6.3, published 12 May 2026.

**Which products and versions are affected?** Subnet Solutions Inc. PowerSYSTEM Center 2024 6.0.x - 6.1.x; Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x.

**Is there a fix for CVE-2026-35555?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-35555 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-35555?** Check whether you run Subnet Solutions Inc. PowerSYSTEM Center 2024 or Subnet Solutions Inc. PowerSYSTEM Center 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the device project groups feature of Subnet Solutions PowerSYSTEM Center. The flaw allows an authenticated attacker with limited permissions to bypass intended access controls and perform unauthorized deletions of project groups. The attack vector is restricted to the adjacent network (AV:A), and exploitation requires valid low-privilege credentials. Successful exploitation impacts system integrity and availability by allowing the removal of organizational data. Subnet Solutions has released updates (PSC 2024 Update 2 and PSC 2026 GA Hotfix) to address this issue.

## Affected products

- Subnet Solutions Inc. PowerSYSTEM Center 2024 6.0.x - 6.1.x
- Subnet Solutions Inc. PowerSYSTEM Center 2026 7.0.x

## Timeline

- 2026-05-12: advisory: CISA published ICSA-26-132-02
- 2026-05-12: disclosed: CVE-2026-35555 published to NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-02.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02)

## Related threats

- [Subnet Solutions PowerSYSTEM Center incorrect authorization in REST API](https://junglewise.ai/threats/cve-2026-26289-subnet-solutions-powersystem-center-incorrect-authorization-in)
- [Subnet Solutions PowerSYSTEM Center CRLF injection in email service](https://junglewise.ai/threats/cve-2026-35504-subnet-solutions-powersystem-center-crlf-injection-in-email)