CVE-2026-63774

Summary

The PowerSYSTEM Center report designer lacks sufficient input validation, enabling an authenticated user to inject and execute arbitrary SQL commands via the report design interface.

Exploitability

Exploitation requires valid authentication and access to the report designer feature, with low additional complexity due to direct SQL injection in user-controlled inputs.

Blast radius

Successful exploitation allows full compromise of the underlying database, including theft or manipulation of sensitive operational data, and potential lateral movement within connected systems.

Detection

Monitor for SQL syntax anomalies in report generation requests logged by the report designer service, especially patterns such as UNION-based payloads, stacked queries, or quoted string termination followed by SQL keywords.

Prioritized remediation

Upgrade to PowerSYSTEM Center version 2.590 or later, where input sanitization and parameterized queries have been implemented in the report designer module.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.