AVEVA Pipeline Integrity Monitor patches four flaws
AVEVA fixed four vulnerabilities in Pipeline Integrity Monitor allowing credential decryption, hash brute-forcing, unauthorized data reads, and stored XSS; no exploitation seen in the wild.
CISA published an ICS advisory for AVEVA Pipeline Integrity Monitor (PIM) versions up to 2025_SP1_P1_build_7.1.9580.8513, affecting critical manufacturing organizations worldwide. Four vulnerabilities were disclosed: a hard-coded cryptographic key issue (CVE-2026-81821) letting anyone with read access to PIMBoards project files decrypt sensitive information; a weak/broken hashing algorithm (CVE-2026-81822) enabling brute-force recovery of PIMBoards user passwords and potential escalation to administrator; a missing authorization flaw (CVE-2026-81823) allowing unauthenticated read access to data intended only for authenticated PIMBoards users; and a reflected/stored cross-site scripting flaw (CVE-2026-81824) that can execute arbitrary JavaScript in a victim's browser session if socially engineered into clicking a malicious link.
AVEVA has released the 2025 SP1 P2 security update, which changes the password hashing algorithm and encryption key management — migration from older project files is one-way, so organizations should migrate promptly, restrict access to non-migratable legacy/backup project files, and force a password reset for all PIMBoards users. CISA notes no known public exploitation of these vulnerabilities at this time. Two of the four CVEs (crypto issues) were reported by AVEVA itself; the other two (authz and XSS) were reported externally via HackerOne by researcher Adham Khairy Ramadan (0xadham).
Standard ICS hardening guidance applies: minimize internet exposure of control system assets, isolate ICS networks behind firewalls, use VPNs for remote access, and train users against phishing/social engineering given the XSS vector requires a user to click a malicious link. This is routine vendor-driven patch guidance rather than an active-exploitation event.
Mentioned in this report
Detection guidance
AVEVA PIMBoards Project File Access with Decryption Attempt
Detects processes attempting to read AVEVA PIMBoards project files (.pimproj or related) which may expose hard-coded cryptographic keys enabling decryption of sensitive data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AVEVA PIMBoards Project File Access with Decryption Attempt
description: Detects suspicious file access to AVEVA PIMBoards project files, which
contain hard-coded cryptographic keys that can be extracted and used to decrypt
sensitive pipeline integrity data. Targets the distinctive .pimproj extension and
parent processes unlikely to be legitimate PIM operations.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- .pimproj
- .pimproj.bak
- .pimproj.backup
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
- \7z.exe
- \winrar.exe
- \curl.exe
- \wget.exe
filter_legitimate_admin:
Image|endswith: \AVEVA.PIMBoards.Server.exe
condition: selection and not filter_legitimate_admin
falsepositives:
- Legitimate backup tools or scheduled tasks accessing project files outside of PIM's
own processes
- System administrators manually backing up project files via command line
level: high
id: 70e5750e-0e28-5b66-bbd9-bc13d5355686
status: experimental
author: Vorant
AVEVA PIMBoards Reflected XSS Exploitation via Spearphishing Link Click
Detects browser execution of JavaScript payloads injected via malicious AVEVA PIMBoards URLs, following social engineering or phishing delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AVEVA PIMBoards Reflected XSS Exploitation via Spearphishing Link Click
description: Detects reflected cross-site scripting (XSS) exploitation in AVEVA PIMBoards
where a victim clicks a malicious link containing JavaScript in query parameters
or POST body, causing arbitrary script execution in the victim's authenticated browser
session (CVE-2026-81824). Monitors for characteristic XSS payload patterns in URLs
targeting PIMBoards endpoints.
tags:
- attack.execution
- attack.t1059.007
- attack.initial-access
- attack.t1566.002
logsource:
category: proxy
product: any
detection:
selection_host:
cs_host|contains: pimboards
selection_payload:
cs_uri_query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- alert(
cs_method: GET
filter_encoded:
cs_uri_query|contains:
- '%3Cscript'
- '%22onload'
condition: (selection_host and selection_payload) or filter_encoded
falsepositives:
- Legitimate web application security testing and penetration testing with approval
- Encoded or escaped user input in search/filter parameters that coincidentally match
XSS patterns
level: medium
id: aa497aeb-72c3-5576-9241-aae0bdb3b174
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-253-01
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free