CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.
CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.
September ICS Patch Tuesday brings critical fixes from Schneider Electric, Siemens, and Aveva, including CVSS 9.2 authentication flaw CVE-2026-3869 in Modicon M580 controllers.
Schneider Electric's September advisories include a critical authentication vulnerability, CVE-2026-3869 with a CVSS score of 9.2, in Modicon M580 and Modicon M580 Safety controllers, plus high-severity bugs in PowerLogic T300 and EcoStruxure IT Data Center Expert. Siemens published nine new advisories, four rated critical across Reyrolle 7SR5, Open Interface Services, Industrial Edge Management, and SIMOVE Fleetmanager and SIPLANT, and began rolling out fixes for CVE-2026-31431, a 7.8-rated Linux kernel flaw enabling root shell access. Aveva disclosed four flaws in Pipeline Integrity Monitor's PIMBoards, including a hardcoded encryption key and MD5-hashed passwords, plus an unsafe deserialization issue in Enterprise SCADA. Rockwell Automation separately issued nine advisories covering RSLinx Classic and multiple controller products.
Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
· Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass
Flawed Authentication Algorithm in Schneider Electric PLC Enables Full Compromise
CVE-2026-3869 is a critical (CVSS 4.0 score 9.2) incorrect implementation of an authentication algorithm (CWE-303) in a Schneider Electric programmable logic controller (PLC), disclosed and patched as part of Schneider Electric's ICS Patch Tuesday release. The flaw is reachable over the network with no privileges or user interaction required, but it carries elevated attack requirements: it comes into play when the PLC is running an application project with a lower application level, which is the configuration precondition for exploitation. An attacker who meets those conditions can defeat the controller's authentication mechanism and cause a complete loss of confidentiality, integrity and availability of the PLC (VC:H/VI:H/VA:H), meaning they could read, modify or disrupt the running control process. Affected users are operators of the impacted Schneider Electric PLC line; the available data does not name the specific model or firmware versions, so operators should confirm their exposure against the official Schneider notification. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, with no reports of exploitation in the wild to date.
· Schneider Electric PLC (specific model line not identified in the available data)large
Weak Password Hashing in PIMBoards Enables Local Brute-Force Privilege Escalation
CVE-2026-81822 is a weak-cryptography flaw (CWE-327) in PIMBoards: users' app-native passwords are stored in project files using a hashing scheme susceptible to computational brute-forcing. An attacker who gains read access to PIMBoards project files (rated as a local attack vector requiring only low privileges and no user interaction) can extract the stored hashes and crack them offline. Recovering a password can potentially elevate the attacker to a PIMBoards administrator account, with high confidentiality impact on the system and subsequent systems per the CVSS 4.0 vector. Any deployment where unauthorized users, shared storage, or backups expose PIMBoards project files is affected; the source data does not specify affected versions or ranges. There is no known exploitation: the flaw has a 0.1% EPSS score (1st percentile), no public proof-of-concept, and is not listed in CISA KEV.
Hard-Coded Cryptographic Key in PIMBoards Exposes Sensitive Data in Project Files
CVE-2026-81821 is a cryptographic weakness in PIMBoards (CWE-321, use of a hard-coded cryptographic key) that leaves data stored in its project files protected only by encryption that anyone can defeat. It is triggered when an attacker with read access to PIMBoards project files — local access per the CVSS 4.0 vector (AV:L with low privileges, no user interaction required) — obtains those files and decrypts them using the embedded key. The attacker gains the ability to decrypt and read sensitive information in the files; the CVSS 4.0 score rates the direct confidentiality impact as High with no direct integrity or availability impact, though subsequent-system confidentiality and integrity impacts are rated High. Users who store PIMBoards project files in locations readable by other users, accounts, or systems are affected, and the source data does not name a vendor or specify affected versions. There are no known public proof-of-concept exploits, no CISA KEV listing, and a low EPSS probability of 0.1%, so exploitation is not currently known to be occurring.
Unauthenticated information disclosure in AVEVA Pipeline Integrity Monitor
CVE-2026-81823 is a missing-authorization flaw (CWE-862) in AVEVA Pipeline Integrity Monitor that allows an unauthenticated remote attacker to invoke read operations intended only for PIMBoards users. It is triggered by sending unauthenticated network requests to the affected read-only functionality, with no special conditions or user interaction required (CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N). A successful exploit yields information disclosure of data readable through PIMBoards; write operations are explicitly not impacted, so attackers cannot modify data through this flaw. At-risk deployments are installations of AVEVA Pipeline Integrity Monitor where the PIMBoards interface is reachable by untrusted network users, a profile typical of pipeline operators' OT environments. No exploitation is currently known: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS estimates a 0.3% probability of exploitation in the next 30 days (24th percentile).
· AVEVA (Schneider Electric) Pipeline Integrity Monitorniche
Cross-Site Scripting (XSS) in AVEVA Pipeline Integrity Monitor PIMBoards
CVE-2026-81824 is a cross-site scripting flaw (CWE-79) in PIMBoards, the dashboard/boards component of AVEVA Pipeline Integrity Monitor. An attacker must socially engineer an authenticated PIMBoards user into clicking a malicious link, which then causes attacker-controlled JavaScript to run inside that user's browser session. Successful exploitation would let the attacker act within the victim's session, and the CVSS 4.0 vector's high integrity and availability impacts on subsequent systems indicate the injected script could take actions affecting connected or downstream systems. Only users of the PIMBoards component of Pipeline Integrity Monitor who follow a malicious link are affected; unexposed or unattended deployments face little risk. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3% (22nd percentile), so exploitation is not currently observed.
· AVEVA Pipeline Integrity Monitor - PIMBoards componentniche
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.