CVE-2026-26289: Sensitive Data Leak in PowerSYSTEM Center

The impact of CVE-2026-26289 is significant due to the potential for unauthorized disclosure of sensitive information. An attacker who has authenticated to PowerSYSTEM Center with limited permissions can exploit this vulnerability to export device account data, which may contain credentials, configuration details, or other confidential information. This data could be used for further attacks, such as privilege escalation or data theft. The blast radius extends to any system or application that relies on the exported device account data. The vulnerability highlights the importance of implementing robust access controls and limiting user permissions to the minimum necessary.

1. Veröffentlicht2026-05-12
2. Geändert2026-05-13

The primary mitigation for CVE-2026-26289 is to upgrade PowerSYSTEM Center to version 5.28.1 or later. If an immediate upgrade is not possible, consider implementing temporary workarounds. Restrict access to the device account export endpoint to only authorized administrative users. Implement multi-factor authentication (MFA) to enhance the security of user accounts. Regularly review user permissions and ensure they are aligned with the principle of least privilege. Monitor PowerSYSTEM Center logs for suspicious activity related to device account exports. Consider implementing a Web Application Firewall (WAF) to filter out unauthorized requests. After upgrading, confirm the fix by attempting to export device account data with a non-administrative user account and verifying that the export is denied.