CVE-2026-26289 - Vulnerability Analysis

Overview

PowerSYSTEM Center REST API contains an information disclosure vulnerability caused by device account export endpoint allowing authenticated users with limited permissions to access sensitive information normally restricted to administrators.

Severity & Score

Impact

Authenticated users with limited permissions can access sensitive administrative information, risking data exposure.

Mitigation

Update to the latest version with access control fixes.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-02

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner