Home / Items
Industrial control advisorySeverity 8.4 high
AVEVA Pipeline Integrity Monitor
ICSA-26-253-01 · CISA · September 10, 2026
Summary
Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code in a browser session.
From CISA, quoted as published. Check the source before acting.
What to do
AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Customers using affected product versions or affected PIMBoards project files should take the following actions to mitigate the risk of exploit: Apply AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate old project files. For project files that cannot be migrated (e.g. backups or transient copies), evaluate the risk of potential password leakage from these files and implement stricter read access controls to protect these unsafe files.
Require AVEVA Pipeline Integrity Monitor PIMBoards users to change their passwords.
Important: PIMBoards Project Files migration from older versions to AVEVA Pipeline Integrity Monitor 2025 SP1 P2 is one-way due to the changes in password hashing algorithms and end-user managed encryption keys.
For more information, see AVEVA security bulletin AVEVA-2026-006. https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-81821 | 8.4 high | No | 0.2% |
| CVE-2026-81822 | 8.4 high | No | 0.1% |
| CVE-2026-81823 | 5.3 medium | No | 0.4% |
| CVE-2026-81824 | 4.7 medium | No | 0.4% |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| AVEVA | Pipeline Integrity Monitor |
Why it's on these mode pages
- Pipeline: Vendor table: AVEVA (matched by rule)
Change history
- September 10, 2026: Initial Republication of AVEVA security bulletin AVEVA-2026-006
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com