CVE-2026-26289 Subnet Solutions CVE debrief

Who should care

Organizations running PowerSYSTEM Center 2020, 2024, or 2026 should pay attention, especially OT/ICS administrators, security teams, and operators who delegate limited user access to the application or its REST API features.

Technical summary

The advisory states that a PowerSYSTEM Center REST API endpoint for device account export can be used by an authenticated user with limited permissions to access sensitive information normally restricted to administrators. The supplied advisory data lists affected product lines across PowerSYSTEM Center 2020, 2024, and 2026, and points to vendor fixes in PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.

Defensive priority

High. This is a sensitive information disclosure issue in an industrial-control management product, and the access boundary involved is administrative versus limited-user permissions. Prioritize patching and review any accounts or workflows that can reach export-related API functions.

Recommended defensive actions

• Update to the vendor-recommended fixed versions: PSC 2020 Update 29, PSC 2024 Update 2, or PSC 2026 GA Hotfix, as applicable to your deployment.
• Review which users and service accounts can access export-related REST API functionality and remove unnecessary privileges where possible.
• Monitor user activity records for unusual or bulk account export activity, and configure a notification rule to alert on bulk export events.
• Follow the vendor's additional hardening guidance where applicable, including restricting access to Notification Settings to trusted administrators and monitoring 'Send from Address' and Activity Records.

Evidence notes

All technical claims here are drawn from the supplied CISA CSAF advisory ICSA-26-132-02 and its referenced CVE record. The advisory text specifically says the REST API device account export endpoint can expose sensitive information to an authenticated user with limited permissions. The supplied record also includes SSVCv2/E:N/A:N/2026-05-11T06:00:00.000000Z and lists the vendor remediation versions. No KEV entry or ransomware linkage is present in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.