by Kastro
Paper/Archive/CVE-2025-65118

CVE-2025-65118

AVEVA Process Optimization — AVEVA Process Optimization Uncontrolled Search Path Element

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 16.7.167 × 203.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.

Affected

ProductAffectedFixed inSource
Process Optimization≤ 2024.1–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
icscert (CNA)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refaveva.com/en/support-and-success/cyber-security-updatesrefsoftwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68earefcisa.gov/news-events/ics-advisories/icsa-26-015-01refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json