Multiple Vulnerabilities Discovered in AVEVA Pipeline Integrity Monitor

On September 10, 2026, CISA published advisory ICSA-26-253-01 detailing four security vulnerabilities in AVEVA Pipeline Integrity Monitor, a critical manufacturing software platform deployed worldwide. The affected product versions are AVEVA Pipeline Integrity Monitor releases up to and including 2025 SP1 P1 build 7.1.9580.8513.

The four CVEs are:
- CVE-2026-81821: Involves the use of a hard-coded cryptographic key, potentially allowing a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.
- CVE-2026-81822: Concerns the use of a broken or risky cryptographic algorithm, which could allow a miscreant with read access to reverse engineer PIMBoards users' app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.
- CVE-2026-81823 and CVE-2026-81824: Additional vulnerabilities detailed in the advisory, involving missing authorization and cross-site scripting during web page generation.

Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session. The CVSS v3.1 base scores for the vulnerabilities range up to 8.4, classified as HIGH severity. The CVSS v4.0 scores also reach 8.3 with high impact on confidentiality and integrity.

Affected sectors include Critical Manufacturing, with the product deployed worldwide. AVEVA, headquartered in the United Kingdom, recommends that organizations apply the AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate old project files. For project files that cannot be migrated, the vendor advises evaluating the risk of potential password leakage and implementing stricter read access controls. Users are also required to change their passwords following migration, as the process is one-way due to changes in password hashing algorithms and end-user managed encryption keys.

For more information, see AVEVA security bulletin AVEVA-2026-006.