Four AVEVA Pipeline Integrity Monitor Flaws Expose Project Data and User Sessions

The US Cybersecurity and Infrastructure Security Agency published an industrial control system advisory on September 10, 2026, covering four vulnerabilities in AVEVA Pipeline Integrity Monitor.

The flaws affect every release up to and including 2025_SP1_P1_build_7.1.9580.8513. They involve hard-coded encryption material, weak password hashing, missing authorization checks, and cross-site scripting within the PIMBoards component.

Two vulnerabilities carry CVSS v3.1 scores of 8.4 and could expose sensitive project information or help attackers recover credentials. The other two permit unauthorized reading of data and browser-side JavaScript execution.

AVEVA recommends installing the Pipeline Integrity Monitor 2025 SP1 P2 Security Update, migrating older projects, and requiring PIMBoards users to change their passwords.

Affected installations span critical manufacturing worldwide

The affected software is AVEVA Pipeline Integrity Monitor, specifically versions at or below:

2025_SP1_P1_build_7.1.9580.8513

The same version range applies to all four vulnerabilities. No narrower range has been disclosed for any individual CVE.

Pipeline Integrity Monitor deployments are associated with the critical manufacturing sector and are used worldwide. That operational context raises the cost of remediation: security teams may need to coordinate updates with engineering, availability, backup, and recovery requirements rather than treating the software like an ordinary office application.

The vulnerabilities primarily concern PIMBoards project files and PIMBoards browser sessions. Their attack paths differ substantially. Two require an attacker to obtain local read access to project files, while another can be reached remotely without authentication. The cross-site scripting issue is also remotely initiated but requires a user to open a malicious link.

CISA’s industrial control system advisory is an initial republication of AVEVA security bulletin AVEVA-2026-006.

Hard-coded encryption and weak hashing create the highest risks

CVE-2026-81821 concerns a hard-coded cryptographic key, classified as CWE-321. An attacker with read access to a PIMBoards project file could use the embedded or predictable key material to decrypt sensitive information within that file.

This is not described as a direct remote compromise. The attacker first needs local access and low-level privileges sufficient to read the affected project data. Once that condition is met, however, the encryption no longer provides an effective boundary.

The vulnerability has a CVSS v3.1 score of 8.4:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

The vector indicates low attack complexity, low required privileges, and no user interaction. It records high confidentiality and integrity consequences, with no direct availability impact. CISA assigns a CVSS v4 score of 8.3.

CVE-2026-81822 affects the hashing of PIMBoards application-native passwords. The software uses a cryptographic algorithm considered broken or risky, placing the weakness under CWE-327.

With read access to a project file, an attacker could extract password hashes and perform computational brute-force attacks. Successful password recovery could expose user accounts and potentially provide PIMBoards administrator privileges.

Its CVSS v3.1 score is also 8.4, using the same vector as CVE-2026-81821:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CISA’s CVSS v4 assessment is 8.3. Both issues are rated high severity under the two scoring systems.

These flaws make copied project files especially sensitive. Backups, temporary exports, migration artifacts, engineering workstation copies, and other retained files can preserve the vulnerable encryption and password-hashing formats even after the production installation has been updated.

Missing authorization permits unauthenticated reading

CVE-2026-81823 is a missing-authorization vulnerability, classified as CWE-862. It allows an unauthenticated attacker to send read requests that should be limited to authenticated PIMBoards users.

Unlike the two cryptographic issues, this vulnerability is network-reachable. It requires neither privileges nor user interaction, and its attack complexity is rated low.

The reported effect is information disclosure. Write operations are not affected, so the issue is not described as allowing unauthenticated modification of PIMBoards data.

Its CVSS v3.1 score is 5.3:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

That assessment records low confidentiality impact and no integrity or availability impact. CISA gives the issue a CVSS v4 score of 6.9. Both systems classify it as medium severity.

Although its score is lower than those of the project-file weaknesses, CVE-2026-81823 has fewer access prerequisites. Defenders should therefore consider whether vulnerable PIMBoards interfaces are reachable from untrusted networks, adjacent business environments, or remote-access infrastructure.

Malicious links can execute JavaScript in PIMBoards sessions

CVE-2026-81824 is a cross-site scripting vulnerability categorized as CWE-79. An attacker can construct a link that causes arbitrary JavaScript to execute in a PIMBoards user’s browser session.

Exploitation depends on social engineering. The targeted user must be persuaded to open the malicious link, making phishing messages and other unsolicited communications plausible delivery mechanisms.

The vulnerability has a CVSS v3.1 score of 4.7:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

The v3.1 assessment assigns low confidentiality impact, no direct integrity or availability impact, and a changed security scope. CISA’s CVSS v4 score is 6.3 and describes low confidentiality impact alongside high subsequent-system integrity and availability effects.

Those assessments should not be collapsed into a single interpretation. The scoring frameworks model the browser-side and downstream consequences differently, although both rate the vulnerability as medium severity.

The security update requires a one-way project migration

AVEVA’s corrective release is the AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update. Organizations should install it and migrate older PIMBoards project files.

Migration requires preparation because it is one-way. Projects converted to the new format cannot simply be returned to their older format. AVEVA attributes that limitation to revised password-hashing methods and encryption keys managed by end users.

Before migration, operators should verify backups and recovery procedures, document dependencies, and test the update against operational workflows. A rollback plan cannot rely on converting an updated project back into its vulnerable legacy format.

Legacy files that cannot be migrated require separate handling. This includes old backups and transient copies retained on workstations, shared storage, removable media, or backup systems. Organizations should restrict read access to those files and assess whether their stored password information may already have been exposed.

All PIMBoards users should change their passwords. Password resets are particularly relevant where affected project files have been accessible to more users or systems than necessary. Any recovered password reused on other services would create additional risk outside PIMBoards, although no specific credential-reuse incidents have been reported.

Defenders should restrict exposure and investigate file access

Control-system devices and supporting services should not be directly exposed to the internet. Pipeline Integrity Monitor environments should sit behind firewalls, with segmentation separating operational networks from general business systems.

Where remote administration is required, organizations should use maintained remote-access mechanisms and secure the connecting endpoints. A VPN does not compensate for an unpatched PIM installation, and the VPN software itself must be kept current.

Security teams should review access records for PIMBoards project files, including backup repositories and shared engineering locations. Relevant warning signs include unexpected file reads, unusual copying or archiving activity, access by low-privileged accounts, and unexplained administrative logins following access to legacy project data.

Web and application logs should also be examined for unauthenticated read requests and suspicious links targeting PIMBoards users. No universal indicators of compromise have been disclosed.

AVEVA reported CVE-2026-81821 and CVE-2026-81822 to CISA. Researcher Adham Khairy Ramadan, also known as 0xadham, reported CVE-2026-81823 and CVE-2026-81824 to AVEVA through HackerOne.

CISA had received no reports of known public exploitation specifically targeting these flaws when it released the advisory. None of the four vulnerabilities has a disclosed CISA Known Exploited Vulnerabilities catalog entry or associated remediation deadline. Suspected exploitation should be handled through established incident-response procedures and reported to CISA.