AVEVA vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-81822 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords tHigh 8.3 · Sep 8, 2026
• CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.High 8.3 · Sep 8, 2026
• CVE-2026-5387 The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (ACritical 9.3 · Apr 15, 2026
• CVE-2026-1507 The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denHigh 8.7 · Feb 10, 2026
• CVE-2025-65118 The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code Critical 9.3 · Jan 15, 2026
• CVE-2025-65117 The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate High 8.5 · Jan 15, 2026
• CVE-2025-64769 The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or High 7.6 · Jan 15, 2026
• CVE-2025-64729 The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and High 8.6 · Jan 15, 2026
• CVE-2025-64691 The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS systCritical 9.3 · Jan 15, 2026
• CVE-2025-61943 The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and aCritical 9.3 · Jan 15, 2026
• CVE-2025-61937 The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potCritical 10 · Jan 15, 2026
• CVE-2025-9317 The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' apHigh 8.3 · Nov 14, 2025
• CVE-2025-8386 The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persistHigh 7.2 · Nov 14, 2025
• CVE-2025-54460 The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to create or access publication targets of type Text File or HDFS) toHigh 7.1 · Aug 21, 2025
• CVE-2025-41415 The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information thatHigh 7.1 · Aug 21, 2025
• CVE-2025-44019 AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PIHigh 7.1 · Jun 12, 2025
• CVE-2025-36539 AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PIHigh 7.1 · Jun 12, 2025
• CVE-2024-6456 AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST IHigh 8.5 · Aug 15, 2024
• CVE-2024-7113 If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of tHigh 8.7 · Aug 13, 2024
• CVE-2024-3468 There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive useHigh 8.4 · Jun 12, 2024
• CVE-2024-3467 There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privilegeHigh 7 · Jun 12, 2024
• CVE-2023-6132 The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by High 7.3 · Feb 29, 2024
• CVE-2023-34348 AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message SubsHigh 7.5 · Jan 18, 2024
• CVE-2021-42797 Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access toHigh 7.5 · Dec 15, 2023
• CVE-2021-42796 An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commandsCritical 9.8 · Dec 15, 2023