en
AVEVA is a multinational software company delivering industrial software for engineering, operations, and asset management; its Pipeline Integrity Monitor (PIM) and PIMBoards dashboards underpin CPM-based pipeline surveillance.
As of 09/20/2026, AVEVA recorded 5 security vulnerabilities in the last 90 days across 3 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Pipeline Integrity Monitor had the most security vulnerabilities in the AVEVA ecosystem, with 4 vulnerabilities—approximately 80% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-81821AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key | Exploitation statusNot known exploited | FixYes | Affected productPipeline Integrity Monitor | Published09/08/2026 | SeverityHigh |
CVE-2026-81822AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm | Exploitation statusNot known exploited | FixYes | Affected productPipeline Integrity Monitor | Published09/08/2026 | SeverityHigh |
CVE-2026-81823AVEVA Pipeline Integrity Monitor Missing Authorization | Exploitation statusNot known exploited | FixYes | Affected productPipeline Integrity Monitor | Published09/08/2026 | SeverityMedium |
CVE-2026-81824AVEVA Pipeline Integrity Monitor cross-site scripting | Exploitation statusNot known exploited | FixYes | Affected productPipeline Integrity Monitor | Published09/08/2026 | SeverityMedium |
CVE-2025-7639AVEVA Enterprise SCADA Deserialization of Untrusted Data | Exploitation statusNot known exploited | FixYes | Affected productAVEVA Enterprise SCADA | Published08/14/2026 | SeverityMedium |
CVE-2026-5387AVEVA Pipeline Simulation Missing Authorization | Exploitation statusNot known exploited | FixYes | Affected productPipeline Simulation 2025 | Published04/15/2026 | SeverityCritical |
CVE-2026-1507Uncaught Exception vulnerability in AVEVA PI Data Archive | Exploitation statusNot known exploited | FixYes | Affected productPI Data Archive PI Server | Published02/10/2026 | SeverityHigh |
CVE-2026-1495Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent | Exploitation statusNot known exploited | FixYes | Affected productPI to CONNECT Agent | Published02/10/2026 | SeverityMedium |
CVE-2025-64769AVEVA Process Optimization Cleartext Transmission of Sensitive Information | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityHigh |
CVE-2025-65117AVEVA Process Optimization Use of Potentially Dangerous Function | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityHigh |
CVE-2025-64729AVEVA Process Optimization Missing Authorization | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityHigh |
CVE-2025-65118AVEVA Process Optimization Uncontrolled Search Path Element | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityCritical |
CVE-2025-61943AVEVA Process Optimization SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityCritical |
CVE-2025-64691AVEVA Process Optimization Code Injection | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityCritical |
CVE-2025-61937AVEVA Process Optimization Code Injection | Exploitation statusNot known exploited | FixYes | Affected productProcess Optimization | Published01/16/2026 | SeverityCritical |
CVE-2025-8386AVEVA Application Server IDE Basic Cross-site Scripting | Exploitation statusNot known exploited | FixYes | Affected productApplication Server | Published11/14/2025 | SeverityHigh |
CVE-2025-9317AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm | Exploitation statusNot known exploited | FixYes | Affected productEdge | Published11/14/2025 | SeverityHigh |
CVE-2025-54460AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type | Exploitation statusNot known exploited | FixYes | Affected productPI Integrator | Published08/21/2025 | SeverityHigh |
CVE-2025-41415AVEVA PI Integrator Insertion of Sensitive Information into Sent Data | Exploitation statusNot known exploited | FixYes | Affected productPI Integrator | Published08/21/2025 | SeverityHigh |
CVE-2025-36539AVEVA PI Data Archive Uncaught Exception | Exploitation statusNot known exploited | FixYes | Affected productPI Data Archive | Published06/12/2025 | SeverityHigh |
CVE-2025-44019AVEVA PI Data Archive Uncaught Exception | Exploitation statusNot known exploited | FixYes | Affected productPI Data Archive | Published06/12/2025 | SeverityHigh |
CVE-2025-2745AVEVA PI Web API Cross-site Scripting | Exploitation statusNot known exploited | FixYes | Affected productPI Web API | Published06/12/2025 | SeverityMedium |
CVE-2025-4418AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value | Exploitation statusNot known exploited | FixYes | Affected productPI Connector for CygNet | Published06/12/2025 | SeverityMedium |
CVE-2025-4417AVEVA PI Connector for CygNet Cross-site Scripting | Exploitation statusNot known exploited | FixYes | Affected productPI Connector for CygNet | Published06/12/2025 | SeverityMedium |
CVE-2024-6456SQL Injection vulnerability in AVEVA Historian Server | Exploitation statusNot known exploited | FixYes | Affected productHistorian Web Server | Published08/15/2024 | SeverityHigh |
CVE-2024-6619Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report | Exploitation statusNot known exploited | FixYes | Affected productReports for Operations 2023 | Published08/13/2024 | SeverityHigh |
CVE-2024-6618Path Traversal in Ocean Data Systems Dream Report | Exploitation statusNot known exploited | FixYes | Affected productReports for Operations | Published08/13/2024 | SeverityHigh |
CVE-2024-7113Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server | Exploitation statusNot known exploited | FixYes | Affected productSuiteLink Server | Published08/13/2024 | SeverityHigh |
CVE-2024-3468Deserialization of Untrusted Data in AVEVA PI Web API | Exploitation statusNot known exploited | FixYes | Affected productPI Web API | Published06/12/2024 | SeverityHigh |
CVE-2024-3467Deserialization of Untrusted Data in AVEVA PI Asset Framework Client | Exploitation statusNot known exploited | FixYes | Affected productPI Asset Framework Client | Published06/12/2024 | SeverityHigh |
CVE-2023-6132AVEVA Edge products Uncontrolled Search Path Element | Exploitation statusNot known exploited | FixYes | Affected productAVEVA Edge | Published02/29/2024 | SeverityHigh |
CVE-2023-34348Improper Check or Handling of Exceptional Conditions in Aveva PI Server | Exploitation statusNot known exploited | FixYes | Affected productPI Server | Published01/18/2024 | SeverityHigh |
CVE-2023-31274Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server | Exploitation statusNot known exploited | FixYes | Affected productPI Server | Published01/18/2024 | SeverityMedium |
CVE-2021-42797 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/16/2023 | SeverityUnknown |
CVE-2021-42794 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/16/2023 | SeverityMedium |
CVE-2021-42796 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/16/2023 | SeverityCritical |
CVE-2023-34982AVEVA Operations Control Logger External Control of File Name or Path | Exploitation statusNot confirmed | FixYes | Affected productSystemPlatform | Published11/15/2023 | SeverityMedium |
CVE-2023-33873AVEVA Operations Control Logger Execution with Unnecessary Privileges | Exploitation statusNot known exploited | FixYes | Affected productSystemPlatform | Published11/15/2023 | SeverityHigh |
CVE-2022-28688 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityHigh |
CVE-2022-36969 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityMedium |
CVE-2022-36970 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityHigh |
CVE-2022-28687 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityHigh |
CVE-2022-28685 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityHigh |
CVE-2022-28686 | Exploitation statusNot known exploited | FixNot confirmed | Affected productEdge | Published03/29/2023 | SeverityHigh |
CVE-2023-1256 | Exploitation statusNot known exploited | FixNot confirmed | Affected productAVEVA Plant SCADA | Published03/16/2023 | SeverityCritical |
CVE-2022-23854 | Exploitation statusNot known exploited | FixYes | Affected productInTouch Access Anywhere | Published12/23/2022 | SeverityHigh |
CVE-2021-38410AVEVA PCS Portal Uncontrolled Search Path Element | Exploitation statusNot known exploited | FixYes | Affected productPlatform Common Services (PCS) Portal | Published07/27/2022 | SeverityHigh |
CVE-2022-1467AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere | Exploitation statusNot known exploited | FixNot confirmed | Affected productAVEVA InTouch Access Anywhere | Published05/23/2022 | SeverityHigh |
CVE-2022-0835AVEVA System Platform Cleartext Storage of Sensitive Information in Memory | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/11/2022 | SeverityHigh |
CVE-2021-33008AVEVA System Platform Missing Authentication for Critical Function | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/04/2022 | SeverityHigh |
CVE-2021-32981AVEVA System Platform Path Traversal | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/04/2022 | SeverityHigh |
CVE-2021-32985AVEVA System Platform Origin Validation Error | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/04/2022 | SeverityHigh |
CVE-2021-33010AVEVA System Platform Uncaught Exception | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/04/2022 | SeverityHigh |
CVE-2021-32977AVEVA System Platform Improper Verification of Cryptographic Signature | Exploitation statusNot known exploited | FixYes | Affected productAVEVA System Platform | Published04/04/2022 | SeverityHigh |
CVE-2021-32987AVEVA SuiteLink Server Null Pointer Dereference | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32999AVEVA SuiteLink Server Improper Handling of Exceptional Conditions | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32979AVEVA SuiteLink Server Null Pointer Dereference | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32971AVEVA SuiteLink Server Null Pointer Dereference | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32959AVEVA SuiteLink Server Buffer Overflow | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32963AVEVA SuiteLink Server Null Pointer Dereference | Exploitation statusNot confirmed | FixYes | Affected productAVEVA System Platform 2020 | Published09/23/2021 | SeverityHigh |
CVE-2021-32942 | Exploitation statusNot confirmed | FixYes | Affected productInTouch | Published06/09/2021 | SeverityMedium |
CVE-2020-13501 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAveva | Published09/24/2020 | SeverityCritical |
CVE-2020-13500 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAveva | Published09/24/2020 | SeverityCritical |
CVE-2020-13499 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAveva | Published09/24/2020 | SeverityCritical |
CVE-2020-13505 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAveva | Published09/24/2020 | SeverityUnknown |
CVE-2020-13504 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAveva | Published09/24/2020 | SeverityUnknown |
CVE-2019-13537 | Exploitation statusNot confirmed | FixNot confirmed | Affected productVijeo Citect and Citect SCADA | Published01/14/2020 | SeverityUnknown |
CVE-2019-10981 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAVEVA Vijeo Citect and CitectSCADA | Published05/31/2019 | SeverityUnknown |
CVE-2019-6525 | Exploitation statusNot confirmed | FixNot confirmed | Affected productWonderware System Platform | Published04/11/2019 | SeverityUnknown |
CVE-2019-6543 | Exploitation statusPublic exploit | FixNot confirmed | Affected productAVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update | Published02/13/2019 | SeverityUnknown |
CVE-2019-6545 | Exploitation statusPublic exploit | FixNot confirmed | Affected productAVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update | Published02/13/2019 | SeverityUnknown |
CVE-2018-17916 | Exploitation statusNot confirmed | FixNot confirmed | Affected productInduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition) | Published11/02/2018 | SeverityUnknown |
CVE-2018-17914 | Exploitation statusNot confirmed | FixNot confirmed | Affected productInduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition) | Published11/02/2018 | SeverityUnknown |
CVE-2018-10628 | Exploitation statusNot confirmed | FixNot confirmed | Affected productInTouch | Published07/24/2018 | SeverityUnknown |
CVE-2018-10620 | Exploitation statusNot confirmed | FixNot confirmed | Affected productInduSoft Web Studio | Published07/19/2018 | SeverityUnknown |
CVE-2017-6021 | Exploitation statusNot confirmed | FixNot confirmed | Affected productClearSCADA | Published05/14/2018 | SeverityUnknown |
CVE-2017-9962 | Exploitation statusNot confirmed | FixNot confirmed | Affected productClearSCADA | Published09/25/2017 | SeverityUnknown |
CVE-2017-5158 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSchneider Electric Wonderware InTouch Access Anywhere | Published04/20/2017 | SeverityUnknown |
CVE-2017-5160 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSchneider Electric Wonderware InTouch Access Anywhere | Published04/20/2017 | SeverityUnknown |
CVE-2017-5156 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSchneider Electric Wonderware InTouch Access Anywhere | Published04/20/2017 | SeverityUnknown |
CVE-2015-0997 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2015 | SeverityUnknown |
CVE-2015-0998 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2015 | SeverityUnknown |
CVE-2015-0999 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2015 | SeverityUnknown |
CVE-2015-0996 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/29/2015 | SeverityUnknown |
CVE-2014-5413Schneider Electric SCADA Expert ClearSCADA Cryptographic Issues | Exploitation statusNot confirmed | FixYes | Affected productClearSCADA | Published09/18/2014 | SeverityMedium |
CVE-2014-5412Schneider Electric SCADA Expert ClearSCADA Improper Authentication | Exploitation statusNot confirmed | FixYes | Affected productClearSCADA | Published09/18/2014 | SeverityMedium |
CVE-2014-5411Schneider Electric SCADA Expert ClearSCADA Cross-site Scripting | Exploitation statusNot confirmed | FixYes | Affected productClearSCADA | Published09/18/2014 | SeverityMedium |
CVE-2014-0779Schneider Electric StruxureWare SCADA Expert ClearSCADA Improper Restriction of Operations within the Bounds of a Memory Buffer | Exploitation statusNot confirmed | FixYes | Affected productClearSCADA | Published03/14/2014 | SeverityMedium |
CVE-2013-6142 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/15/2014 | SeverityUnknown |
CVE-2011-3144 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/16/2011 | SeverityUnknown |
CVE-2011-3143 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/16/2011 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
%20Portal.svg){kind=icon}
%20prior%20to%20Version%202017%20Update.svg){kind=icon}
.svg){kind=icon}
