Critical Deserialization Vulnerability Affects AVEVA Enterprise SCADA Versions 2021 Through 2025

A significant vulnerability in AVEVA Enterprise SCADA, tracked as CVE-2025-7639, was publicly disclosed on August 13, 2026. The issue stems from the improper handling of serialized data within the product's deserialization processes. According to CISA and AVEVA advisories, a threat actor with authenticated access and "DNA Authority - Operator" privilege could exploit this weakness to tamper with serialized data, potentially leading to code execution during deserialization under the privileges of the "DNA Apps" security group.

The vulnerability affects a broad range of AVEVA Enterprise SCADA versions, including Enterprise SCADA 2025, and all supported releases back to Enterprise SCADA 2021 SP2 P5. Enterprise SCADA HMI versions 2024, 2024 R2, and all releases up to and including 2023_P1 are also affected. The CVSS v3 base score is 7.1, reflecting the authenticated exploitation vector and the potential impact on system integrity and availability.

AVEVA notes that the risk is elevated for systems still using the Binary Formatter serialization mode. The vendor recommends that administrators evaluate their operational environment, upgrade affected servers and clients to the specified fixed versions, and reconfigure serialization settings from "Binary Formatter" to "Json" mode. Specifically, the "AcceptBinaryFormattedData" setting should be changed from "true" to "false," and XOS Event Handlers assemblies should be re-cached following upgrades.

AVEVA has published detailed mitigation steps in KB117814, the "AVEVA Midstream Product Bulletin - Removal of Binary Formatter." General defensive measures include auditing device permissions to ensure only trusted users hold "DNA Authority - Operator" rights and disallowing BLT Test clients in production environments. As of the advisory date, no public exploit code has been confirmed, but the authenticated nature of the flaw and its presence in critical manufacturing environments necessitates prompt attention from affected organizations.