AVEVA Patches Hard-Coded Crypto Key in Pipeline Software
Security / news
AVEVA Patches Hard-Coded Crypto Key in Pipeline Software
Two of the four flaws let anyone who can read a saved project file decrypt the passwords inside it, and the fix requires migrating old files rather than just installing an update.
AVEVA has patched four vulnerabilities in Pipeline Integrity Monitor, software used to watch midstream oil and gas pipelines for leaks, including a hard-coded cryptographic key that let anyone with read access to a saved project file decrypt the passwords stored inside it.
The Cybersecurity and Infrastructure Security Agency published an advisory on the flaws Sept. 10, 2026, covering AVEVA Pipeline Integrity Monitor versions up to and including 2025_SP1_P1_build_7.1.9580.8513. Industrial security outlet ISSSource reported the same day that AVEVA itself found and reported two of the four flaws to CISA, while an outside researcher, Adham Khairy Ramadan, reported the other two. The advisory landed the same week as September's Patch Tuesday round of fixes, another reminder that industrial vendors run their own disclosure calendars independent of the monthly cycle most enterprise software follows.
Four flaws, two ways in
| CVE | Flaw | CVSS v3.1 | Found By |
|---|---|---|---|
| CVE-2026-81821 | Hard-coded cryptographic key | 8.4 | AVEVA |
| CVE-2026-81822 | Broken cryptographic algorithm | 8.4 | AVEVA |
| CVE-2026-81823 | Missing authorization | 5.3 | Adham Khairy Ramadan |
| CVE-2026-81824 | Cross-site scripting | 4.7 | Adham Khairy Ramadan |
CVE-2026-81821 and CVE-2026-81822, the two AVEVA reported itself, both score 8.4 on the CVSS v3.1 scale and both trace to the same root cause: PIMBoards project files encrypt sensitive information with a cryptographic key baked into the software rather than generated per installation, using an algorithm ISSSource describes as broken. Anyone who obtains read access to a project file, without needing to run the software or authenticate to it, can decrypt what is inside, according to CISA's advisory. ISSSource's report adds that an attacker could go further, reverse-engineering weak password hashes through brute-force computation to escalate to administrator privileges.
The other two flaws need a working login
The lower-severity pair both require some level of existing access. CVE-2026-81823, a missing-authorization flaw scoring 5.3, allows unauthorized read operations, though CISA's advisory notes write operations are not affected. CVE-2026-81824, a cross-site scripting flaw scoring 4.7, can be triggered by a malicious link that executes arbitrary JavaScript inside a victim's browser session, according to the advisory.
Why the fix is not just an update
AVEVA's remediation, per CISA's advisory, is the 2025 SP1 P2 Security Update, but the company is also telling customers to migrate their existing project files rather than simply install the patch over them, since files encrypted under the old hard-coded key stay decryptable by anyone who has a copy, patched software or not. For project files that cannot be migrated, AVEVA's guidance is to tighten read access controls and treat any password stored in them as potentially exposed, requiring resets.
CISA's advisory states there are no known active exploits of any of the four flaws, and ISSSource's report does not name specific pipeline operators running the affected builds. That gap, what portion of the software's install base has actually migrated its project files rather than just patched the application, sits alongside the similar patch-versus-exposure question CISA raised this month with exploited MikroTik RouterOS devices: a fix existing is not the same as a fix reaching every affected file.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.