Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-35555

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

High7.0EPSS 0.15%
Published
Updated
Reserved
Assigned by
icscert

Description

PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

Scores

CVSS scores of CVE-2026-35555, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0High7.0CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
icscertCNA (assigner)3.1Medium6.3CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
NVDNVD · Awaiting Analysis4.0High7.0CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.15% · top 95% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

Affected products

What to do

Solution: Subnet Solutions recommends users update to the latest version of PowerSYSTEM Center PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix. For assistance in upgrading, users should contact a Subnet Solutions System Integration team member or customer support team at (403) 270-8885 or by email at [[email protected]](mailto:[email protected]). Subnet Solutions recommends users do the following in order to reduce risk: * Monitor user activity records to ensure users are following acceptable usage policies of the application. * Restrict access to Notification Settings to trusted Administrators Monitor "Send from Address" in settings and Activity Records. * Configure a notification rule that triggers in any bulk account export activity.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-35555 badge
[![CVE-2026-35555](https://trackcve.app/badge/CVE-2026-35555.svg)](https://trackcve.app/cve/CVE-2026-35555)

Record last updated .