Security1 publisher2 min readPublished
A hard-coded key opens any PIMBoards project file an attacker can read
CISA's advisory covers four CVEs in AVEVA Pipeline Integrity Monitor builds up to 2025 SP1 P1. The fix reaches only the project files you can migrate, and the migration to SP1 P2 cannot be undone.
The Watch · Security desk
What happened
- CISA's advisory ICSA-26-253-01 lists four CVEs, CVE-2026-81821 through CVE-2026-81824, against AVEVA Pipeline Integrity Monitor builds at or below 2025_SP1_P1_build_7.1.9580.8513.
- A hard-coded cryptographic key, CWE-321, means an attacker with read access to PIMBoards project files can decrypt and view the sensitive information they hold.
- A second defect, CWE-327, lets the same reader brute-force weak hashes back into PIMBoards app-native passwords, which AVEVA says can elevate the attacker to a PIMBoards administrator.
- A third defect lets an unauthenticated attacker run read operations intended only for PIMBoards users, disclosing information; write operations are not affected.
- AVEVA's remediation is the 2025 SP1 P2 security update plus migration of old project files, and it tells customers to make every PIMBoards user change their password.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Because the project-file migration runs one way, SP1 P2 is a commitment rather than a staged trial: once files move, there is no reading them with an older build.
- exposure Copies that cannot be migrated keep the old cryptography, so the exposure sits on file shares, backup targets and engineering endpoints rather than on the application host.
- decision AVEVA keeps the impact judgement with the customer, so whether unmigrated project files amount to a password leak is a call each pipeline integrity team makes against its own architecture.
- cost A forced password change for every PIMBoards user, plus re-permissioning every archived copy of a project file, is labour the operator absorbs and the update does not do for them.
Read access to a PIMBoards project file is a filesystem privilege, not an application one, and it is all that two of the three described defects require [15]. The third needs neither a file nor a credential [7]. That splits the work into two inventories: everywhere a project file has ever been copied, and whatever can reach the PIMBoards read interface.
The advisory does not help much with the second. It carries no CVSS values, no statement of known exploitation, and no attack-vector detail for the unauthenticated read path [17]. Priority has to come from the precondition instead of a score.
There is also an accounting gap. Four CVE IDs are listed against builds up to 2025_SP1_P1_build_7.1.9580.8513 [1], and three mechanisms are described [5][6][7], which leaves one ID with no mechanism attached in the advisory text [14]. The summary line names three impact classes, and one of them, running arbitrary code in a browser session [3], matches none of the three descriptions. AVEVA's own bulletin, AVEVA-2026-006, is where that mapping would sit [13].
The irreversibility has a stated cause: SP1 P2 changes the password hashing algorithm and moves to end-user managed encryption keys, so a migrated project file cannot be read by the older build [12]. Files that cannot go forward, which the advisory names as backups and transient copies, keep the old cryptography, and AVEVA's instruction for them is to evaluate the risk of password leakage and apply stricter read access controls [10]. That phrasing repeats in every remediation block: evaluate the impact based on your operational environment, architecture, and product implementation [8]. For a pipeline integrity team, that is an ACL review of every archive target and every laptop that ever held an export, on the vendor's word that only the customer can see that layout.
Nothing here is a mass-exploitation story. The product is listed as critical manufacturing, deployed worldwide, from a vendor headquartered in the United Kingdom [4], and the defects are a stored-credential problem rather than a remote foothold, with writes explicitly out of scope on the unauthenticated path [7]. The chain that matters ends in a PIMBoards administrator account reached by brute-forcing hashes lifted out of a file [6]. Patching the application does not close that if the old files survive on a share, and the file inventory is the one thing AVEVA's remediation text cannot supply [8][10].
What to watch
- Whether AVEVA-2026-006 maps each of the four CVE IDs to a mechanism, including the browser-session code execution named in the CISA summary.
- Publication of CVSS vectors, and whether the unauthenticated read path is network-reachable in a default Pipeline Integrity Monitor deployment.
- Any first report of exploitation against pre-P2 builds or against archived PIMBoards project files.