The reported issue is a CRLF injection flaw in the PowerSYSTEM Center email notification service when SMTPS is used. The flaw allows an attacker who can influence the body or header of the notification message to inject carriage return and line feed characters, potentially adding or modifying SMTP headers. This could lead to forging email content or hijacking notification flows, threatening integrity and possibly enabling malicious emails to be sent from the system.

Subnet Solutions’ PowerSYSTEM Center for the years 2020, 2024 and 2026 are impacted. The bug is fixed in PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.

CVSS score 5.1 suggests moderate severity. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, publicly documented exploitation has not been reported. The attack vector is likely remote, via legitimate email notification requests that the attacker can manipulate, possibly by forging inputs during configuration or export operations. The vendor recommends monitoring user activity and restricting notification settings to trusted administrators, but the most effective protection is to apply the vendor‑issued patch.