AVEVA Pipeline Integrity Monitor
CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.
CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.
- Four CVEs affect AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7.1.9580.8513.
- CVE-2026-81821 and CVE-2026-81822 score 8.4 HIGH but require local read access to project files.
- CVE-2026-81823 allows unauthenticated read access; CVE-2026-81824 enables XSS via malicious links.
- AVEVA self-reported two flaws; two more came via HackerOne from researcher 0xadham.
- No known public exploitation reported at time of publication.
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-81821+1 related CVE | Hard-Coded Cryptographic Key in PIMBoards Exposes Sensitive Data in Project Files | 8.3 | <1% | ||
| CVE-2026-81823 | Unauthenticated information disclosure in AVEVA Pipeline Integrity Monitor | 6.9 | <1% | ||
| CVE-2026-81824 | Cross-Site Scripting (XSS) in AVEVA Pipeline Integrity Monitor PIMBoards | 6.3 | <1% |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. The following versions of AVEVA Pipeline Integrity Monitor are affected: AVEVA Pipeline Integrity Monitor <=2025_SP1_P1_build_7. 1.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.