CVE-2026-35504 Overview
CVE-2026-35504 is a Carriage Return Line Feed (CRLF) injection vulnerability in the PowerSYSTEM Center email notification service. The flaw manifests when the service uses Simple Mail Transfer Protocol Secure (SMTPS) communication. An authenticated attacker on an adjacent network can inject CRLF sequences into email notification traffic. This vulnerability is tracked under CWE-93: Improper Neutralization of CRLF Sequences. The issue was disclosed through a CISA Industrial Control Systems (ICS) advisory.
Critical Impact
Authenticated attackers on adjacent networks can manipulate SMTPS email notification streams, potentially altering message content, injecting headers, or affecting notification integrity in operational technology environments.
Affected Products
- PowerSYSTEM Center (email notification service component)
- Deployments configured to use SMTPS for outbound email notifications
- Refer to the CISA ICS Advisory ICSA-26-132-02 for version-specific details
Discovery Timeline
- 2026-05-12 - CVE-2026-35504 published to the National Vulnerability Database (NVD)
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-35504
Vulnerability Analysis
The vulnerability resides in the email notification service of PowerSYSTEM Center. When the service communicates with a mail server over SMTPS, it fails to neutralize CRLF (\r\n) sequences in user-influenced input before constructing SMTP protocol messages. SMTP relies on CRLF as a structural delimiter between headers, between headers and the body, and between protocol commands. Injecting raw CRLF pairs into a field that is later concatenated into SMTP traffic allows an attacker to break out of the intended field context.
Exploitation requires an authenticated attacker (PR:L) with adjacent network access (AV:A), which constrains the practical attack surface to users already present on the operational network segment. The impact spans confidentiality, integrity, and availability at a low level, consistent with CRLF abuse that manipulates protocol structure rather than achieving direct code execution.
Root Cause
The root cause is improper neutralization of CRLF sequences ([CWE-93]) in input that flows into SMTPS protocol messages. The notification service does not strip or encode \r and \n characters before embedding attacker-influenced values into SMTP headers or commands.
Attack Vector
An authenticated user on the adjacent network supplies input containing embedded CRLF sequences to a field consumed by the email notification service. When the service generates the outbound SMTPS message, the injected sequences are interpreted as protocol-level delimiters. This enables header injection, message body smuggling, or insertion of additional SMTP commands within the encrypted channel to the mail server.
No verified public proof-of-concept code is available. See the GitHub CSAF File and CISA ICS Advisory for vendor-provided technical detail.
Detection Methods for CVE-2026-35504
Indicators of Compromise
- Outbound SMTPS messages from PowerSYSTEM Center hosts containing unexpected additional headers, duplicate To:, Bcc:, or Subject: fields, or anomalous MIME boundaries
- Email notification log entries with input fields containing raw %0d%0a, \r\n, or literal control characters
- Notifications delivered to recipients not configured in the PowerSYSTEM Center notification policy
Detection Strategies
- Inspect application and audit logs for the email notification service for input strings containing CR (0x0D) or LF (0x0A) bytes in notification recipient, subject, or body fields
- Correlate authentication events on adjacent network segments with subsequent malformed SMTPS sessions originating from the PowerSYSTEM Center host
- Monitor the mail relay for messages from PowerSYSTEM Center that deviate from the expected header template
Monitoring Recommendations
- Enable verbose logging on the PowerSYSTEM Center email notification service and forward logs to a centralized SIEM for retention and analysis
- Baseline normal SMTPS traffic volume, message size, and header structure from PowerSYSTEM Center hosts, then alert on deviations
- Track authenticated user activity on adjacent OT network segments and flag accounts that interact with notification configuration endpoints
How to Mitigate CVE-2026-35504
Immediate Actions Required
- Review the CISA ICS Advisory ICSA-26-132-02 and apply the vendor-provided fix for affected PowerSYSTEM Center versions
- Restrict access to PowerSYSTEM Center management interfaces and notification configuration to the minimum set of authenticated users
- Segment PowerSYSTEM Center hosts from general corporate networks and limit adjacent network access to authorized engineering workstations
Patch Information
Refer to the CISA ICS Advisory ICSA-26-132-02 and the corresponding GitHub CSAF File for vendor-supplied patched versions and update procedures. No public exploit is available and the EPSS score is 0.008% as of 2026-05-17.
Workarounds
- Where patching is not immediately feasible, disable the SMTPS email notification feature or route notifications through a hardened mail relay that strips CRLF sequences from message headers
- Enforce strict input validation policies on any field that feeds into the notification service and reject input containing \r or \n bytes
- Apply network access control lists to allow SMTPS traffic from PowerSYSTEM Center only to the designated mail server
# Example: block non-mail-server SMTPS egress from a PowerSYSTEM Center host (Linux iptables)
iptables -A OUTPUT -p tcp --dport 465 -d <mail-server-ip> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 465 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
