{"id":"CVE-2026-63017","published":"2026-11-06T01:17:50.297","lastModified":"2026-11-06T01:17:50.297","description":"Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json","tags":[]}],"hasPoc":true,"ai":{"summary":"A low-privileged, authenticated user can bypass intended access controls in PowerSYSTEM Center to access administrative resources due to incorrect authorization enforcement.","exploitability":"Exploitation requires a valid, low-privileged account and knowledge of protected endpoints; network proximity is needed as the attack vector is adjacent (AV:A).","blast_radius":"Successful exploitation grants full administrative access, enabling data exfiltration, system modification, or service disruption across the entire system.","remediation":"Apply vendor patch version 2.590 or later, which resolves the authorization flaw; if unavailable, restrict access to administrative endpoints to users with elevated privileges only.","detection":"Monitor for low-privileged users accessing administrative API endpoints (e.g., /admin/*, /api/v1/admin/*) or performing privileged actions (e.g., user creation, config changes); look for anomalous privilege escalation in audit logs or session tokens with admin scope issued to non-admin accounts.","tags":["auth-bypass","privilege-escalation","ics","web-app"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:46:56.005Z"}}