CVE-2025-64691 AVEVA CVE debrief

Who should care

AVEVA Process Optimization administrators, OT/ICS security teams, system owners managing Model Application Server deployments, and defenders responsible for host, service, and file-access controls on affected systems.

Technical summary

CISA’s advisory describes a local privilege-escalation path in AVEVA Process Optimization. The issue is reachable by an authenticated user with OS Standard User privileges and can be used to tamper with TCL Macro scripts, escalating to OS System. The supplied CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting local attack conditions, low privileges required, no user interaction, and high impacts across confidentiality, integrity, and availability with scope change.

Defensive priority

High. The issue is remotely unremarkable but operationally serious because a low-privilege authenticated user on the host can move to full system-level compromise of the Model Application Server.

Recommended defensive actions

• Update to AVEVA Process Optimization v2025 using the vendor-provided fix.
• Apply host and/or network firewall rules so the taoimr service accepts traffic only from trusted sources.
• Restrict access to the default listening ports 8888/8889 (TLS) according to the AVEVA Process Optimization Installation Guide.
• Apply ACLs to installation and data folders so only trusted users can write to them.
• Maintain a trusted chain-of-custody for Process Optimization project files during creation, modification, distribution, backups, and use.
• Review AVEVA’s security bulletin AVEVA-2026-001 for additional vendor guidance.

Evidence notes

All substantive claims above come from the supplied CISA CSAF source item for ICSA-26-015-01 and its embedded remediation guidance. The source describes the privilege-escalation condition, the affected product name, the OS Standard User prerequisite, the Model Application Server impact, and the mitigation steps. The CVSS vector is taken from the supplied source metadata. No exploit code or offensive reproduction steps are included.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.