CVE-2026-26289: PowerSYSTEM Center Info Disclosure Flaw

CVE-2026-26289 Overview

CVE-2026-26289 is an authorization flaw in the PowerSYSTEM Center REST API endpoint used for device account export. The vulnerability allows an authenticated user with limited permissions to retrieve sensitive information that should be restricted to administrative roles only. The flaw is tracked under CWE-863: Incorrect Authorization and was published as part of CISA Industrial Control Systems advisory ICSA-26-132-02. The issue affects deployments where low-privilege accounts can reach the affected API surface over an adjacent network.

Critical Impact
A low-privileged authenticated user on the adjacent network can extract device account data normally reserved for administrators, exposing credentials and configuration tied to operational technology assets.

Affected Products

PowerSYSTEM Center (REST API component for device account export)
Deployments referenced in CISA advisory ICSA-26-132-02
Operational technology environments running affected PowerSYSTEM Center versions

Discovery Timeline

2026-05-12 - CVE CVE-2026-26289 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-26289

Vulnerability Analysis

The vulnerability resides in a REST API endpoint of PowerSYSTEM Center that handles device account export operations. The endpoint authenticates the requesting user but fails to enforce role-based authorization checks on the returned data set. As a result, a user holding only limited permissions receives the same response payload as an administrator. The exposed information includes device account records, which typically contain identifiers and credential material used to manage industrial control assets. Because the issue stems from broken access control rather than authentication, valid session tokens or API keys for non-admin accounts are sufficient to trigger the disclosure.

Root Cause

The root cause is incorrect authorization on a privileged API route, classified as CWE-863. The endpoint trusts the authenticated session without re-evaluating the caller's role against the sensitivity of the export operation. This is a server-side enforcement gap rather than a client-side UI restriction issue.

Attack Vector

The attack vector is adjacent network, meaning the attacker must reach the management network where PowerSYSTEM Center is exposed. Exploitation requires low privileges and no user interaction. An attacker with credentials for any limited user account issues a request to the device account export endpoint and parses the returned data offline. No memory corruption, injection, or chained vulnerabilities are required to retrieve sensitive content.

No public proof-of-concept code is referenced in the advisory. See the CISA ICS Advisory ICSA-26-132-02 and the CSAF JSON document for vendor-provided details.

Detection Methods for CVE-2026-26289

Indicators of Compromise

REST API calls to the PowerSYSTEM Center device account export endpoint originating from non-administrative user accounts.
Unusual volume of export responses returned to client workstations that do not host administrative roles.
Authentication events from limited-permission accounts followed by access to administrative API routes.

Detection Strategies

Audit PowerSYSTEM Center application and web server logs for any access to device account export endpoints by accounts not assigned an administrative role.
Correlate API access logs with the directory of authorized administrators to flag privilege mismatches.
Alert on outbound transfers of device account data from the PowerSYSTEM Center host to unexpected internal endpoints.

Monitoring Recommendations

Enable verbose request logging on the REST API, capturing user identity, endpoint, and response size.
Forward PowerSYSTEM Center logs to a centralized log platform and apply detection rules for unauthorized export attempts.
Monitor east-west traffic between operator workstations and the PowerSYSTEM Center management interface for anomalous API patterns.

How to Mitigate CVE-2026-26289

Immediate Actions Required

Apply the vendor-supplied update referenced in CISA ICS Advisory ICSA-26-132-02 once available for your deployment.
Restrict network access to the PowerSYSTEM Center management interface to a dedicated administrative VLAN or jump host.
Review and reduce the number of limited-permission accounts that can authenticate to the REST API.
Rotate device account credentials that may have been exposed if unauthorized export access is suspected.

Patch Information

Refer to the CISA ICS Advisory ICSA-26-132-02 and the CSAF JSON document for the authoritative list of fixed versions and vendor remediation guidance. Schedule the update during a maintenance window appropriate for operational technology systems.

Workarounds

Block access to the device account export endpoint at a reverse proxy or web application firewall for all non-administrative source identities.
Enforce network segmentation so only administrator workstations can reach PowerSYSTEM Center management ports.
Disable or remove unused limited-permission accounts to reduce the population of identities that can reach the vulnerable endpoint.

bash

# Example reverse proxy rule (conceptual) to restrict access to export endpoint
# Replace <ADMIN_CIDR> with the network range of authorized administrator workstations
location /api/devices/accounts/export {
    allow <ADMIN_CIDR>;
    deny  all;
    proxy_pass http://powersystem-center-backend;
}