CVE-2026-35555: PowerSYSTEM Center Auth Bypass Flaw

CVE-2026-35555 Overview

CVE-2026-35555 is an authorization flaw in the PowerSYSTEM Center device project groups feature. An authenticated user with limited permissions can delete project groups without proper authorization checks. The weakness is classified as [CWE-863] Incorrect Authorization. The vulnerability is exploitable over an adjacent network and requires low-privileged authenticated access. Successful exploitation results in unauthorized deletion of project group data, impacting operational integrity of the affected industrial control system environment.

Critical Impact
Authenticated low-privileged users on the adjacent network can delete PowerSYSTEM Center device project groups, causing loss of configuration data and disruption to industrial control workflows.

Affected Products

PowerSYSTEM Center (device project groups feature)
Refer to the CISA ICS Advisory ICSA-26-132-02 for specific affected versions
Refer to the GitHub CSAF File for machine-readable advisory data

Discovery Timeline

2026-05-12 - CVE-2026-35555 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-35555

Vulnerability Analysis

The vulnerability resides in the device project groups feature of PowerSYSTEM Center. The application authenticates the requester but fails to enforce role-based authorization when processing project group deletion requests. As a result, any authenticated user — including accounts intended to hold limited or read-only roles — can issue a delete operation against project groups. Loss of project group records disrupts the logical grouping of devices and configuration data used by operators. The flaw maps to [CWE-863] Incorrect Authorization, where access control logic exists but evaluates the wrong condition or fails to validate user permissions against the requested action.

Root Cause

The root cause is a missing or incomplete authorization check on the delete action for project groups. The server-side handler trusts the authenticated session and does not verify that the user holds a role permitted to remove project group objects.

Attack Vector

Exploitation requires network adjacency and a valid low-privileged account. An attacker with credentials on the same logical or local network segment as PowerSYSTEM Center can invoke the delete operation through the standard interface. No user interaction is required. The attack does not yield code execution or data disclosure, but it produces a high integrity impact through unauthorized destruction of project group configuration.

No public proof-of-concept code is available. See the CISA ICS Advisory ICSA-26-132-02 for technical details published by the vendor and CISA.

Detection Methods for CVE-2026-35555

Indicators of Compromise

Unexpected deletion events for device project groups within PowerSYSTEM Center audit logs
Project group delete actions performed by accounts that should not hold administrative roles
Sudden loss of device-to-project-group associations in operator dashboards

Detection Strategies

Enable and centralize PowerSYSTEM Center application audit logging, with focus on project group create, modify, and delete events
Correlate delete actions with the originating user account role to flag privilege-permission mismatches
Alert on bulk or repeated project group deletion events within a short time window

Monitoring Recommendations

Forward PowerSYSTEM Center logs to a centralized SIEM or data lake for retention and correlation
Monitor adjacent-network traffic to PowerSYSTEM Center management interfaces for anomalous administrative API calls
Track authentication events for low-privileged accounts that subsequently perform configuration-changing actions

How to Mitigate CVE-2026-35555

Immediate Actions Required

Apply the vendor patch referenced in CISA ICS Advisory ICSA-26-132-02 as soon as it is available for your deployment
Review and reduce the number of accounts with access to PowerSYSTEM Center, removing unused or stale credentials
Audit existing project group records and back up current configuration state before remediation

Patch Information

Consult the CISA ICS Advisory ICSA-26-132-02 and the corresponding GitHub CSAF File for vendor-supplied fixed versions and update instructions.

Workarounds

Restrict network access to the PowerSYSTEM Center management interface to trusted administrative workstations only
Segment the operational technology network so adjacent-network attack paths to PowerSYSTEM Center are minimized
Enforce strong authentication and rotate credentials for any low-privileged accounts that interact with the system
Increase the frequency of configuration backups so that any unauthorized deletion can be quickly reverted

bash

# Example: restrict access to PowerSYSTEM Center management port using host firewall
# Replace 10.10.0.0/24 with your administrative subnet and adjust the port to match your deployment
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP