REST API Vulnerability in PowerSYSTEM Center by CISA
CVE-2026-26289
8.4HIGH
What is CVE-2026-26289?
The PowerSYSTEM Center REST API contains a vulnerability that allows authenticated users with limited permissions to access sensitive information typically restricted to administrative roles. This loophole could potentially expose critical data, raising significant security concerns for organizations relying on the PowerSYSTEM Center. Proper access controls and regular security audits are essential to mitigate risks related to this vulnerability.
Affected Version(s)
PowerSYSTEM Center 2020 5.8.x <= 5.28.x
PowerSYSTEM Center 2024 6.0.x <= 6.1.x
PowerSYSTEM Center 2026 7.0.x
References
CVSS V4
Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Kelly Stich of Subnet Solutions Inc. reported these vulnerabilities to CISA.