AVEVA Patches Hard-Coded Crypto Key in Pipeline Software

AVEVA has patched four vulnerabilities in Pipeline Integrity Monitor, software used to watch midstream oil and gas pipelines for leaks, including a hard-coded cryptographic key that let anyone with read access to a saved project file decrypt the passwords stored inside it.

The Cybersecurity and Infrastructure Security Agency published an advisory on the flaws Sept. 10, 2026, covering AVEVA Pipeline Integrity Monitor versions up to and including 2025_SP1_P1_build_7.1.9580.8513. Industrial security outlet ISSSource reported the same day that AVEVA itself found and reported two of the four flaws to CISA, while an outside researcher, Adham Khairy Ramadan, reported the other two. The advisory landed the same week as September's Patch Tuesday round of fixes, another reminder that industrial vendors run their own disclosure calendars independent of the monthly cycle most enterprise software follows.

Four flaws, two ways in

CVE	Flaw	CVSS v3.1	Found By
CVE-2026-81821	Hard-coded cryptographic key	8.4	AVEVA
CVE-2026-81822	Broken cryptographic algorithm	8.4	AVEVA
CVE-2026-81823	Missing authorization	5.3	Adham Khairy Ramadan
CVE-2026-81824	Cross-site scripting	4.7	Adham Khairy Ramadan

CVE-2026-81821 and CVE-2026-81822, the two AVEVA reported itself, both score 8.4 on the CVSS v3.1 scale and both trace to the same root cause: PIMBoards project files encrypt sensitive information with a cryptographic key baked into the software rather than generated per installation, using an algorithm ISSSource describes as broken. Anyone who obtains read access to a project file, without needing to run the software or authenticate to it, can decrypt what is inside, according to CISA's advisory. ISSSource's report adds that an attacker could go further, reverse-engineering weak password hashes through brute-force computation to escalate to administrator privileges.

The other two flaws need a working login

The lower-severity pair both require some level of existing access. CVE-2026-81823, a missing-authorization flaw scoring 5.3, allows unauthorized read operations, though CISA's advisory notes write operations are not affected. CVE-2026-81824, a cross-site scripting flaw scoring 4.7, can be triggered by a malicious link that executes arbitrary JavaScript inside a victim's browser session, according to the advisory.

Why the fix is not just an update

AVEVA's remediation, per CISA's advisory, is the 2025 SP1 P2 Security Update, but the company is also telling customers to migrate their existing project files rather than simply install the patch over them, since files encrypted under the old hard-coded key stay decryptable by anyone who has a copy, patched software or not. For project files that cannot be migrated, AVEVA's guidance is to tighten read access controls and treat any password stored in them as potentially exposed, requiring resets.

CISA's advisory states there are no known active exploits of any of the four flaws, and ISSSource's report does not name specific pipeline operators running the affected builds. That gap, what portion of the software's install base has actually migrated its project files rather than just patched the application, sits alongside the similar patch-versus-exposure question CISA raised this month with exploited MikroTik RouterOS devices: a fix existing is not the same as a fix reaching every affected file.