PowerSchool Products Status

Resolved: The SAML (SSO) and MFA authentication issues affecting SchoolMessenger Communicate have been resolved. Our teams have completed remediation and monitored the environment to confirm service stability. We appreciate your patience while we worked to resolve this issue.

Monitoring: Remediation has been implemented for the SAML (SSO) and MFA authentication issues affecting SchoolMessenger Communicate. Our teams are monitoring the environment and customer experience to confirm service stability. We will continue to provide updates as additional information becomes available.

Identified: Our teams have identified a configuration-related issue affecting SAML (SSO) and MFA authentication within SchoolMessenger Communicate. Remediation is underway to address the issue and restore normal authentication functionality. We will provide further updates as progress is made.

Investigating: We are investigating reports of login issues within SchoolMessenger Communicate. We are working diligently to mitigate the issue being reported and will continue to provide regular updates as we progress towards a resolution.

Investigating: We are continuing to investigate this issue.

Investigating: We are investigating an issue affecting access to Customer Central from select PowerSchool products. Some users may see a browser security error when they select the Customer Central link in their product.

Resolved: Behavior Support and NeverSkip have now been patched. With these updates complete, all affected PowerSchool products have now been successfully patched.

Identified: Naviance has now been patched, joining Professional Learning, Perform Enterprise, SchoolSpring, SchoolMessenger Communicate, Schoology, and PowerSource.

Remediation remains underway for Behavior Support and NeverSkip. PowerSchool continues to prioritize patching for these remaining affected products.

Identified: Professional Learning and Perform Enterprise have now been patched, joining SchoolSpring, SchoolMessenger Communicate, Schoology, and PowerSource.

Remediation remains underway for Behavior Support, Naviance and NeverSkip. PowerSchool continues to prioritize patching for these remaining affected products.

Identified: SchoolSpring, SchoolMessenger Communicate, Schoology and PowerSource have been patched.

Remediation remains underway for Behavior Support, Naviance, NeverSkip, Professional Learning, and Perform Enterprise. PowerSchool continues to prioritize patching for these remaining affected products.

Please Note: PowerSchool has confirmed that PowerSchool SIS and Analytics & Insights are not affected by CVE-2026-109618 or CVE-2026-109619. These products were included on the prior list in error and have been removed from the list below.

Identified: Correction: PowerSchool SIS was included in the original list in error and has been removed from the list below.

Identified: We are continuing to work on a fix for this issue.

Identified: PowerSchool Response to Critical PHP Vulnerabilities:

PowerSchool is aware of two recently disclosed critical vulnerabilities affecting PHP, CVE-2026-109618 and CVE-2026-109619. PHP is an open-source server-side programming language commonly used to support web-based applications. PowerSchool uses PHP within certain components of several products to support web and application functionality. Both vulnerabilities have been rated critical and security updates have been released for supported PHP versions.

PowerSchool Security and Engineering teams are actively assessing our products and environments to determine potential exposure and implement appropriate remediation.

Based on our assessment to date, the following PowerSchool products use PHP and are being evaluated and remediated as appropriate:

Behavior Support Naviance NeverSkip Professional Learning Perform Enterprise PowerSource Schoology SchoolMessenger Communicate SchoolSpring

Remediation and Mitigation:

PowerSchool is actively working to apply applicable security updates across affected PowerSchool-hosted environments and to make applicable product updates available for self-hosted deployments.

In parallel with these remediation efforts, PowerSchool is engaging with its Web Application Firewall (WAF) providers to evaluate additional protections intended to help reduce potential exposure. PowerSchool also continues to monitor its environments using endpoint detection and response (EDR) capabilities for indicators of suspicious activity. These measures provide additional layers of defense while patching remains the priority.

For self-hosted customers, PowerSchool recommends applying the applicable PowerSchool-provided product update as soon as it becomes available. While remediation is underway, customers should consider implementing appropriate defense-in-depth measures within their environments, including leveraging available WAF and endpoint security protections and monitoring affected systems for unusual or suspicious activity.

These additional measures are intended to help reduce potential exposure while remediation is underway and are not a substitute for applying the applicable PowerSchool-provided update.

PowerSchool will continue to take appropriate remediation and mitigation actions as its assessment progresses.

Investigating: PowerSchool is aware of recently disclosed critical security vulnerabilities affecting PHP. Our Security and Engineering teams are actively assessing the potential impact across our products and implementing protective measures as appropriate.

For PowerSchool-hosted environments, additional protections are being applied to help mitigate potential threats while our teams continue evaluation and remediation efforts. At this time, our investigation remains ongoing.

We are working to provide product-specific guidance and will share additional information as it becomes available. Protecting our customers' data and systems remains our highest priority.