CVE-2026-33570 Subnet Solutions CVE debrief

Who should care

OT/ICS operators, PowerSYSTEM Center administrators, security teams responsible for device access controls, and incident responders monitoring authenticated user activity in industrial environments.

Technical summary

The advisory describes a REST API endpoint issue in PowerSYSTEM Center where authorization checks do not adequately enforce operational permission boundaries for device information. The supplied CSAF metadata and CVSS vector indicate an authenticated, low-privilege attacker can access high-confidentiality data without user interaction. The advisory maps to an improper-authorization condition consistent with CWE-863. CISA's remediation guidance points to vendor updates for PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix, along with monitoring and administrative controls intended to reduce misuse of privileged workflows.

Defensive priority

Medium-high. The issue does not appear to enable code execution or service disruption in the supplied data, but it does expose sensitive operational information to users who should not see it. In OT settings, that can materially improve an attacker's situational awareness and should be remediated promptly.

Recommended defensive actions

• Apply the vendor-recommended updates: PowerSYSTEM Center 2020 Update 29, PSC 2024 Update 2, or PSC 2026 GA Hotfix, as applicable to your deployment.
• Review device REST API access paths and confirm low-privilege authenticated users cannot retrieve data outside their operational role.
• Monitor user activity records for unusual access patterns and verify users are following acceptable application usage policies.
• Restrict access to Notification Settings to trusted administrators and monitor 'Send from Address' changes and Activity Records.
• Configure a notification rule to alert on bulk account export activity.
• Use the advisory and official CVE/NVD records to verify version applicability before scheduling maintenance windows.

Evidence notes

All statements are based on the supplied CISA CSAF advisory record for ICSA-26-132-02 / CVE-2026-33570 and the linked official CVE/NVD resources. The source text explicitly states that a low-privilege authenticated user can access information normally limited by operational permissions. The CVSS vector, score, publication date, and remediation items are taken from the provided corpus. No exploit code, proof-of-concept, or unverified impact claims are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.