# AVEVA Pipeline Integrity Monitor patches four flaws Published: 2026-09-10 · Severity: routine · Sectors: manufacturing, energy Canonical: https://vorant.io/reports/79f0daec-6447-53da-9ff3-c1f79f550f90/aveva-pipeline-integrity-monitor-patches-four-flaws > AVEVA fixed four vulnerabilities in Pipeline Integrity Monitor allowing credential decryption, hash brute-forcing, unauthorized data reads, and stored XSS; no exploitation seen in the wild. CISA published an ICS advisory for AVEVA Pipeline Integrity Monitor (PIM) versions up to 2025_SP1_P1_build_7.1.9580.8513, affecting critical manufacturing organizations worldwide. Four vulnerabilities were disclosed: a hard-coded cryptographic key issue (CVE-2026-81821) letting anyone with read access to PIMBoards project files decrypt sensitive information; a weak/broken hashing algorithm (CVE-2026-81822) enabling brute-force recovery of PIMBoards user passwords and potential escalation to administrator; a missing authorization flaw (CVE-2026-81823) allowing unauthenticated read access to data intended only for authenticated PIMBoards users; and a reflected/stored cross-site scripting flaw (CVE-2026-81824) that can execute arbitrary JavaScript in a victim's browser session if socially engineered into clicking a malicious link. AVEVA has released the 2025 SP1 P2 security update, which changes the password hashing algorithm and encryption key management — migration from older project files is one-way, so organizations should migrate promptly, restrict access to non-migratable legacy/backup project files, and force a password reset for all PIMBoards users. CISA notes no known public exploitation of these vulnerabilities at this time. Two of the four CVEs (crypto issues) were reported by AVEVA itself; the other two (authz and XSS) were reported externally via HackerOne by researcher Adham Khairy Ramadan (0xadham). Standard ICS hardening guidance applies: minimize internet exposure of control system assets, isolate ICS networks behind firewalls, use VPNs for remote access, and train users against phishing/social engineering given the XSS vector requires a user to click a malicious link. This is routine vendor-driven patch guidance rather than an active-exploitation event. ## Mentioned in this report - Vulnerabilities: CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824 ## Detection guidance (public sample) ### AVEVA PIMBoards Project File Access with Decryption Attempt ATT&CK: T1552.001 Detects processes attempting to read AVEVA PIMBoards project files (.pimproj or related) which may expose hard-coded cryptographic keys enabling decryption of sensitive data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: AVEVA PIMBoards Project File Access with Decryption Attempt description: Detects suspicious file access to AVEVA PIMBoards project files, which contain hard-coded cryptographic keys that can be extracted and used to decrypt sensitive pipeline integrity data. Targets the distinctive .pimproj extension and parent processes unlikely to be legitimate PIM operations. tags: - attack.credential-access - attack.t1552.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .pimproj - .pimproj.bak - .pimproj.backup Image|endswith: - \cmd.exe - \powershell.exe - \cscript.exe - \wscript.exe - \7z.exe - \winrar.exe - \curl.exe - \wget.exe filter_legitimate_admin: Image|endswith: \AVEVA.PIMBoards.Server.exe condition: selection and not filter_legitimate_admin falsepositives: - Legitimate backup tools or scheduled tasks accessing project files outside of PIM's own processes - System administrators manually backing up project files via command line level: high id: 70e5750e-0e28-5b66-bbd9-bc13d5355686 status: experimental author: Vorant ``` ### AVEVA PIMBoards Reflected XSS Exploitation via Spearphishing Link Click ATT&CK: T1566.002 Detects browser execution of JavaScript payloads injected via malicious AVEVA PIMBoards URLs, following social engineering or phishing delivery. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: AVEVA PIMBoards Reflected XSS Exploitation via Spearphishing Link Click description: Detects reflected cross-site scripting (XSS) exploitation in AVEVA PIMBoards where a victim clicks a malicious link containing JavaScript in query parameters or POST body, causing arbitrary script execution in the victim's authenticated browser session (CVE-2026-81824). Monitors for characteristic XSS payload patterns in URLs targeting PIMBoards endpoints. tags: - attack.execution - attack.t1059.007 - attack.initial-access - attack.t1566.002 logsource: category: proxy product: any detection: selection_host: cs_host|contains: pimboards selection_payload: cs_uri_query|contains: -