AVEVA PI Data Archive DoS via uncaught exception
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two uncaught exception flaws in AVEVA PI Data Archive allow authenticated users to trigger denial of service and data loss.
CISA has published an advisory detailing two uncaught exception vulnerabilities (CVE-2025-44019 and CVE-2025-36539) affecting AVEVA PI Data Archive and PI Server across multiple versions. Both vulnerabilities require authentication and allow a malicious or compromised user to crash necessary PI Data Archive subsystems, resulting in denial of service. CVE-2025-44019 also risks data loss in write cache and snapshots due to timing of the crash. The vulnerabilities are remotely exploitable with low attack complexity, rated CVSS 7.1 and 6.5 respectively.
Affected versions include PI Data Archive 2018 SP3 Patch 4 and prior, version 2023 and 2023 Patch 1, as well as corresponding PI Server versions. The advisory indicates no active exploitation has been reported to CISA. AVEVA recommends upgrading to PI Server 2024 or higher, or alternatively to PI Server 2018 SP3 Patch 7 or higher for legacy systems. Additional mitigations include monitoring PI Network Manager and PI Archive Subsystem service health, setting services to auto-restart, and restricting port 5450 access to trusted workstations only.
Mentioned in this report
Detection guidance
AVEVA PI Network Manager or Archive Subsystem Service Crash
Detects unexpected termination of the PI Network Manager or PI Archive Subsystem services, the observable effect of the uncaught-exception DoS in the AVEVA PI Data Archive advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AVEVA PI Network Manager or Archive Subsystem Service Crash
id: 8d2e79a1-4d92-5538-a2ef-e79e957dcc63
status: experimental
description: Detects unexpected termination of PI Network Manager or PI Archive Subsystem
services (Service Control Manager events 7031, 7034, 7024). The uncaught-exception
vulnerabilities CVE-2025-44019 and CVE-2025-36539 let an authenticated user crash
these subsystems, causing denial of service and possible loss of write cache and
snapshot data. Repeated events in a short window raise confidence.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07
tags:
- attack.impact
- attack.t1561
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID:
- 7031
- 7034
- 7024
param1|contains:
- PI Network Manager
- PI Archive Subsystem
condition: selection
falsepositives:
- Service crashes caused by faulty patching or an unrelated software bug on the PI
server
- Unclean shutdown or host resource exhaustion on the PI server
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs