These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-5387 is a critical privilege-escalation issue in AVEVA Pipeline Simulation. According to the CISA CSAF advisory, an unauthenticated attacker could perform actions intended only for Simulator Instructor or Simulator Developer (Administrator) roles, with potential impact to simulation parameters, training configuration, and training records. The advisory lists an available vendor fix and recommends [truncated]
CVE-2026-1507 is a high-severity availability issue in AVEVA PI Data Archive / PI Server. According to the CISA CSAF advisory, an unauthenticated attacker can trigger an uncaught exception that may remotely crash core PI services, resulting in denial of service. For industrial and OT environments, the main concern is service disruption rather than data theft or code execution.
CVE-2026-1495 is an information-disclosure issue in AVEVA PI to CONNECT Agent. According to CISA’s CSAF advisory, a user with Windows Event Log Reader privileges can recover proxy details, including the proxy URL and credentials, from PI to CONNECT event log files. That exposure could let an attacker use the proxy server without authorization. AVEVA’s guidance is to upgrade affected systems and review exi [truncated]
CVE-2025-65118 affects AVEVA Process Optimization and was publicly republished by CISA on 2026-01-15 as ICSA-26-015-01. The advisory says an authenticated OS Standard User could trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, with potential complete compromise of the Model Application Server. CISA rates the issue 8.8 (HIGH), reflecting serious impact e [truncated]
CVE-2025-65117 is a HIGH-severity vulnerability in AVEVA Process Optimization. According to the CISA advisory, an authenticated Process Optimization Designer User can embed OLE objects into graphics and, if a victim user later interacts with those graphical elements, escalate privileges to the victim’s identity. The advisory lists a CVSS v3.1 score of 7.4 (AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) and recommen [truncated]
CVE-2025-64769 affects AVEVA Process Optimization and was publicly disclosed in CISA advisory ICSA-26-015-01 on 2026-01-15. The advisory says the application suite uses connection channels/protocols that are, by default, not encrypted and may be subject to hijacking or data leakage in certain man-in-the-Middle or passive inspection scenarios. AVEVA and CISA list product updates and network/host hardening [truncated]
CVE-2025-64729 is a high-severity AVEVA Process Optimization vulnerability disclosed by CISA on 2026-01-15. According to the advisory, an authenticated OS standard user could tamper with Process Optimization project files, embed code, and then escalate privileges to the identity of a victim user who later interacts with those files. AVEVA’s guidance centers on updating to the fixed release and hardening f [truncated]
CVE-2025-64691 is a high-severity vulnerability in AVEVA Process Optimization. According to CISA’s CSAF advisory, an authenticated miscreant with OS Standard User access could tamper with TCL Macro scripts and escalate privileges to OS System, with potential for complete compromise of the Model Application Server. The advisory was published on 2026-01-15 and includes vendor guidance to update to AVEVA Pro [truncated]
CVE-2025-61943 is a high-severity AVEVA Process Optimization vulnerability disclosed by CISA on 2026-01-15. According to the advisory, an authenticated Process Optimization Standard User may tamper with Captive Historian queries and achieve code execution under SQL Server administrative privileges, which could lead to full SQL Server compromise.
CVE-2025-61937 is a critical AVEVA Process Optimization issue disclosed by CISA on 2026-01-15. According to the advisory, exploitation could allow an unauthenticated attacker to achieve remote code execution under OS System privileges of the "taoimr" service, potentially leading to complete compromise of the Model Application Server. AVEVA recommends updating to Process Optimization v2025 and, where neede [truncated]
CVE-2025-8386 is a configuration-time flaw in AVEVA Application Server IDE. According to the CISA advisory, an authenticated user with aaConfigTools privileges can tamper with App Objects' help files and persist a cross-site scripting payload that may be triggered by a victim user, enabling horizontal or vertical privilege escalation. AVEVA states that runtime components and operations are not affected, a [truncated]