AVEVA SCADA Deserialization Flaw Enables Code Execution
An authenticated deserialization vulnerability in AVEVA Enterprise SCADA could let a privileged operator achieve code execution, no public exploitation observed.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory for AVEVA Enterprise SCADA products affected by CVE-2025-7639, a deserialization of untrusted data vulnerability (CWE-502). An attacker who already holds "DNA Authority - Operator" privileges could tamper with serialized data to trigger code execution during deserialization, running under the elevated privileges of the "DNA Apps" security group. The flaw affects multiple Enterprise SCADA and Enterprise SCADA HMI versions from 2021 through 2025, and by extension AVEVA Pipeline Operations, Pipeline Integrity Monitor, and Measurement Advisor products that share the same binary serialization component.
AVEVA's remediation requires upgrading server and client components to fixed versions and then reconfiguring the BinarySerializer mode from 'Binary Formatter' to 'Json', disabling AcceptBinaryFormattedData, and migrating HMI displays — a multi-step process detailed in vendor KB117814. CISA notes the vulnerability has high attack complexity and no known public exploitation has been reported. The advisory is primarily relevant to Critical Manufacturing and broader industrial/pipeline operators using AVEVA SCADA deployed worldwide, and organizations should prioritize auditing operator privilege assignments and disallowing BLT test clients in production alongside the patching timeline.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs