{"id":"CVE-2026-63774","published":"2026-11-06T01:17:50.470","lastModified":"2026-11-06T01:17:50.470","description":"Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The PowerSYSTEM Center report designer lacks sufficient input validation, enabling an authenticated user to inject and execute arbitrary SQL commands via the report design interface.","exploitability":"Exploitation requires valid authentication and access to the report designer feature, with low additional complexity due to direct SQL injection in user-controlled inputs.","blast_radius":"Successful exploitation allows full compromise of the underlying database, including theft or manipulation of sensitive operational data, and potential lateral movement within connected systems.","remediation":"Upgrade to PowerSYSTEM Center version 2.590 or later, where input sanitization and parameterized queries have been implemented in the report designer module.","detection":"Monitor for SQL syntax anomalies in report generation requests logged by the report designer service, especially patterns such as UNION-based payloads, stacked queries, or quoted string termination followed by SQL keywords.","tags":["sql-injection","web","ics","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:47:02.318Z"}}