CVE-2026-35504 Subnet Solutions CVE debrief

Who should care

Organizations running Subnet Solutions PowerSYSTEM Center 2020, 2024, or 2026 deployments that use the email notification service over SMTPS. Administrators responsible for notification settings, activity monitoring, and email routing should prioritize review.

Technical summary

The advisory identifies a CRLF injection condition in the PowerSYSTEM Center email notification service during SMTPS communication. CRLF injection (CWE-93) can allow attacker-controlled line breaks to alter email headers or message structure if the affected input is not properly handled. The supplied advisory assigns CVSS 3.1 5.5/Medium and includes SSVC metadata, but no KEV listing is present in the supplied corpus.

Defensive priority

Medium. The issue is publicly disclosed and vendor-fixed, but the supplied corpus does not indicate KEV inclusion or active exploitation. Systems that expose or rely on the affected notification service should be updated promptly.

Recommended defensive actions

• Update to the vendor-fixed releases listed in the advisory: PSC 2020 Update 29, PSC 2024 Update 2, or PSC 2026 GA Hotfix, as applicable to your deployment.
• Restrict access to Notification Settings to trusted administrators.
• Monitor the "Send from Address" setting and Activity Records for unexpected changes.
• Monitor user activity records to confirm users are following acceptable application-use policies.
• Configure a notification rule that triggers on bulk account export activity.
• Follow CISA ICS recommended practices for operational hardening and monitoring.

Evidence notes

Primary evidence comes from the CISA CSAF advisory (ICSA-26-132-02) published 2026-05-12 and mirrored in the supplied source item. The advisory explicitly states: "PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when using SMTPS communication." It also provides vendor mitigations and remediation versions. The supplied enrichment shows no KEV entry and no ransomware-campaign association.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.