The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to tamper with Process Optimization project files,
embed code, and escalate their privileges to the identity of a victim
user who subsequently interacts with the project files.
AVEVA recommends users take the following action:
* Update to AVEVA Process Optimization v2025 https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea
For more information, please
AVEVA's security bulletin AVEVA-2026-001 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .
Configurations
Workarounds
AVEVA alternatively recommends the following actions users can take to mitigate risk:
* Apply host and/or network firewall rules restricting the taoimr
service to accept traffic only from trusted source(s). By default, AVEVA
Process Optimization listens on port 8888/8889(TLS). Please refer to
the AVEVA Process Optimization Installation Guide for additional details
on ports configuration.
* Apply ACLs to the installation and data folders, limiting write-access to trusted users only.
* Maintain a trusted chain-of-custody on Process Optimization project
files during creation, modification, distribution, backups, and use.
For more information, please
AVEVA's security bulletin AVEVA-2026-001 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .
Exploits
Credits
finder
Christopher Wu of Veracode reported these vulnerabilities to AVEVA.