Vulnerabilidades de AVEVA
CVEs publicadas que afetam produtos de AVEVA: 12 registro(s), com severidade, exploração e correções.
Process Optimization 7PI to CONNECT Agent 1PI Data Archive PI Server 1Edge 1Pipeline Simulation 2025 1Application Server 1
CVE-2026-5387
Crítica · 9.3
CWE-862 15/04/2026
Escalonamento de privilégio por falta de autorização no produto de simulação AVEVA (CVE-2026-5387)
A vulnerabilidade, se explorada, poderia permitir que um agente malicioso não autenticado executasse operações destinadas apenas às funções de Simulator Instructor ou Simulator Developer (Administrador), resultando em escalonamento de privilégio com possibilidade de modificação de parâmetros de simulação, configuração de treinamento e registros de treinamento.
CVE-2026-1507
Alta · 7.5
CWE-248 10/02/2026
Uncaught Exception vulnerability in AVEVA PI Data Archive
The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.
CVE-2026-1495
Média · 6.5
CWE-532 10/02/2026
Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent
The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy server.
CVE-2025-65118
Alta · 8.8
CWE-427 15/01/2026
AVEVA Process Optimization Uncontrolled Search Path Element
The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to trick Process Optimization services into loading
arbitrary code and escalate privileges to OS System, potentially
resulting in complete compromise of the Model Application Server.
CVE-2025-65117
Alta · 7.7
CWE-676 15/01/2026
AVEVA Process Optimization Use of Potentially Dangerous Function
The vulnerability, if exploited, could allow an authenticated miscreant
(Process Optimization Designer User) to embed OLE objects into graphics,
and escalate their privileges to the identity of a victim user who
subsequently interacts with the graphical elements.
CVE-2025-64769
Alta · 7.1
CWE-319 15/01/2026
AVEVA Process Optimization Cleartext Transmission of Sensitive Information
The Process Optimization application suite leverages connection
channels/protocols that by-default are not encrypted and could become
subject to hijacking or data leakage in certain man-in-the-middle or
passive inspection scenarios.
CVE-2025-64729
Alta · 8.2
CWE-862 15/01/2026
AVEVA Process Optimization Missing Authorization
The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to tamper with Process Optimization project files,
embed code, and escalate their privileges to the identity of a victim
user who subsequently interacts with the project files.
CVE-2025-64691
Alta · 8.8
CWE-94 15/01/2026
AVEVA Process Optimization Code Injection
The vulnerability, if exploited, could allow an authenticated miscreant
(OS standard user) to tamper with TCL Macro scripts and escalate
privileges to OS system, potentially resulting in complete compromise of
the model application server.
CVE-2025-61943
Alta · 7.8
CWE-89 15/01/2026
AVEVA Process Optimization SQL Injection
The vulnerability, if exploited, could allow an authenticated miscreant
(Process Optimization Standard User) to tamper with queries in Captive
Historian and achieve code execution under SQL Server administrative
privileges, potentially resulting in complete compromise of the SQL
Server.
CVE-2025-61937
Crítica · 10.0
CWE-94 15/01/2026
AVEVA Process Optimization Code Injection
The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” service, potentially resulting in complete compromise of the model application server.
CVE-2025-9317
Alta · 8.4
CWE-327 14/11/2025
AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm
The vulnerability, if exploited, could allow a miscreant with read
access to Edge Project files or Edge Offline Cache files to reverse
engineer Edge users' app-native or Active Directory passwords through
computational brute-forcing of weak hashes.
CVE-2025-8386
Média · 6.9
CWE-80 14/11/2025
AVEVA Application Server IDE Basic Cross-site Scripting
The vulnerability, if exploited, could allow an authenticated miscreant
(with privilege of "aaConfigTools") to tamper with App Objects' help
files and persist a cross-site scripting (XSS) injection that when
executed by a victim user, can result in horizontal or vertical
escalation of privileges. The vulnerability can only be exploited during
config-time operations within the IDE component of Application Server.
Run-time components and operations are not affected.