AVEVA Pipeline Integrity Monitor patches four flaws
AVEVA fixed four vulnerabilities in Pipeline Integrity Monitor allowing credential decryption, hash brute-forcing, unauthorized data reads, and stored XSS; no exploitation seen in the wild.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory for AVEVA Pipeline Integrity Monitor (PIM) versions up to 2025_SP1_P1_build_7.1.9580.8513, affecting critical manufacturing organizations worldwide. Four vulnerabilities were disclosed: a hard-coded cryptographic key issue (CVE-2026-81821) letting anyone with read access to PIMBoards project files decrypt sensitive information; a weak/broken hashing algorithm (CVE-2026-81822) enabling brute-force recovery of PIMBoards user passwords and potential escalation to administrator; a missing authorization flaw (CVE-2026-81823) allowing unauthenticated read access to data intended only for authenticated PIMBoards users; and a reflected/stored cross-site scripting flaw (CVE-2026-81824) that can execute arbitrary JavaScript in a victim's browser session if socially engineered into clicking a malicious link.
AVEVA has released the 2025 SP1 P2 security update, which changes the password hashing algorithm and encryption key management — migration from older project files is one-way, so organizations should migrate promptly, restrict access to non-migratable legacy/backup project files, and force a password reset for all PIMBoards users. CISA notes no known public exploitation of these vulnerabilities at this time. Two of the four CVEs (crypto issues) were reported by AVEVA itself; the other two (authz and XSS) were reported externally via HackerOne by researcher Adham Khairy Ramadan (0xadham).
Standard ICS hardening guidance applies: minimize internet exposure of control system assets, isolate ICS networks behind firewalls, use VPNs for remote access, and train users against phishing/social engineering given the XSS vector requires a user to click a malicious link. This is routine vendor-driven patch guidance rather than an active-exploitation event.
Mentioned in this report
Detection guidance
AVEVA PIMBoards Project File Access with Decryption Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects processes attempting to read AVEVA PIMBoards project files (.pimproj or related) which may expose hard-coded cryptographic keys enabling decryption of sensitive data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AVEVA PIMBoards Project File Access with Decryption Attempt
description: Detects suspicious file access to AVEVA PIMBoards project files, which
contain hard-coded cryptographic keys that can be extracted and used to decrypt
sensitive pipeline integrity data. Targets the distinctive .pimproj extension and
parent processes unlikely to be legitimate PIM operations.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- .pimproj
- .pimproj.bak
- .pimproj.backup
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
- \7z.exe
- \winrar.exe
- \curl.exe
- \wget.exe
filter_legitimate_admin:
Image|endswith: \AVEVA.PIMBoards.Server.exe
condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate backup tools or scheduled tasks accessing project files outside of PIM's
own processes
- System administrators manually backing up project files via command line
level: high
id: 70e5750e-0e28-5b66-bbd9-bc13d5355686
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-253-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs