by Kastro
Paper/Archive/CVE-2026-5387

CVE-2026-5387

AVEVA Pipeline Simulation 2025 — AVEVA Pipeline Simulation Missing Authorization

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 32.9.329 × 206.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.

Affected

ProductAffectedFixed inSource
Pipeline Simulation 2025≤ 2025 SP1 (build 7.1.9497.6351)–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdfrefsoftwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6frefcisa.gov/news-events/ics-advisories/icsa-26-106-04refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json