CVE-2026-5387: AVEVA Simulation Product Missing Authorization Privilege Escalation
CVE-2026-5387 is a critical missing authorization weakness described in an ICS-CERT advisory, in which an unauthenticated attacker could perform operations reserved for Simulator Instructor or Simulator Developer (Administrator) roles. The record reports a CVSS 4.0 base score of 9.3 assigned by the CNA, but the affected product versions and fixes are not listed in the record. No confirmed exploitation is recorded in the sources consulted, and the CVE is not in CISA KEV.
Overview
CVE-2026-5387 is classified as CWE-862 (Missing Authorization). According to the CNA description, an unauthenticated user could reach operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles. The advisory is referenced as ICSA-26-106-04 by CISA and as AVEVA-2026-004 by the vendor bulletin.
Impact
- The description states potential privilege escalation.
- Possible effects include modification of simulation parameters, training configuration, and training records.
- The CVSS 4.0 vector in the record reports high confidentiality and integrity impact on the vulnerable system and no impact on subsequent systems.
Affected products and versions
The record does not list affected products or versions. The vendor bulletin and the CISA advisory listed in the references should be consulted to determine which AVEVA simulation products and versions are impacted.
Exploitation status
CISA KEV does not list this CVE in the record, so no active exploitation is confirmed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Review the AVEVA security bulletin and the CISA advisory to identify affected products and the vendor-recommended updates.
- Restrict network access to simulation and training systems to authorized personnel and segment them from untrusted networks.
- Audit accounts with Instructor and Developer roles and review recent changes to simulation parameters and training records.
Detection guidance
- Monitor for changes to simulation parameters, training configurations, and training records outside expected maintenance windows.
- Review logs for privileged operations performed by accounts that should not hold those roles.
Limitations of the available information
The record does not include affected versions, fixed versions, product names, or patch details. The CVSS environmental and threat metrics are set to X (not defined). The EPSS probability is 0.00496 with a percentile of 0.40876. The advisory documents were not reviewed in this analysis, so vendor-specific details remain unknown.
Frequently asked questions
What is CVE-2026-5387?
It is a critical missing authorization vulnerability (CWE-862) that could let an unauthenticated user perform operations meant for Simulator Instructor or Developer roles.
Is CVE-2026-5387 being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record does not list affected or fixed versions. Consult the AVEVA bulletin and the CISA advisory for product details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.