AVEVA Pipeline Integrity Monitor: 4 CVEs, High 8.4
Summary
CISA reports 4 vulnerabilities in AVEVA Pipeline Integrity Monitor. Weakness types: Use of Hard-coded Cryptographic Key, Use of a Broken or Risky Cryptographic Algorithm, Missing Authorization (+1 more). Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. Highest CVSS v3 score: 8.4 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- AVEVA
- Products
- Pipeline Integrity Monitor
- CVEs
- CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824
- Highest CVSS v3
- 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United Kingdom
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-81821 | Use of Hard-coded Cryptographic Key | 8.4 | – | No | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. |
| CVE-2026-81822 | Use of a Broken or Risky Cryptographic Algorithm | 8.4 | – | No | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users' app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user. |
| CVE-2026-81823 | Missing Authorization | 5.3 | – | No | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted. |
| CVE-2026-81824 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 4.7 | – | No | The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link. |
Affected products (1)
- AVEVA Pipeline Integrity Monitor: <=2025_SP1_P1_build_7.1.9580.8513
Vendor fixes and mitigations (from advisory)
- Vendor Fix: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected product versions or affected PIMBoards project files should take the following actions to mitigate the risk of exploit: Apply AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate old project files. For project files that cannot be migrated (e.g. backups or transient copies), evaluate the risk of potential password leakage from these files and implement stricter read access controls to prot
- Vendor Fix: Require AVEVA Pipeline Integrity Monitor PIMBoards users to change their passwords.
- Vendor Fix: Important: PIMBoards Project Files migration from older versions to AVEVA Pipeline Integrity Monitor 2025 SP1 P2 is one-way due to the changes in password hashing algorithms and end-user managed encryption keys.
- Mitigation: For more information, see AVEVA security bulletin AVEVA-2026-006. https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.