Aveva vulnerabilities, page 5
91 vulnerabilities
Known vulnerabilities in Aveva products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 68 products.
CriticalCVE-2026-5387aveva · pipeline simulation 2025AVEVA Pipeline Simulation Missing AuthorizationThe vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.EPSS0.50%MediumCVE-2026-81824aveva · pipeline integrity monitorAVEVA Pipeline Integrity Monitor cross-site scriptingThe vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.EPSS0.37%MediumCVE-2026-81823aveva · pipeline integrity monitorAVEVA Pipeline Integrity Monitor Missing AuthorizationThe vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.EPSS0.38%HighCVE-2026-81822aveva · pipeline integrity monitorAVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic AlgorithmThe vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.EPSS0.11%HighCVE-2026-81821aveva · pipeline integrity monitorAVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic keyThe vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.EPSS0.15%CriticalCVE-2023-1256aveva · aveva_plant_scada +2 moreCVE-2023-1256The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.EPSS0.68%MediumCVE-2023-31274aveva · pi_serverMissing Release of Resource after Effective Lifetime vulnerability in Aveva PI ServerAVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.EPSS0.50%HighCVE-2023-6132aveva · aveva_edge +1 moreAVEVA Edge products Uncontrolled Search Path ElementThe vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.EPSS0.19%HighCVE-2023-34348aveva · pi_serverImproper Check or Handling of Exceptional Conditions in Aveva PI ServerAVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.EPSS0.56%HighCVE-2023-34982aveva · application server +21 moreAVEVA Operations Control Logger External Control of File Name or PathThis external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.EPSS0.22%HighCVE-2023-33873aveva · application server +21 moreAVEVA Operations Control Logger Execution with Unnecessary PrivilegesThis privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.EPSS0.24%