On September 10, 2026, CISA published advisory ICSA-26-253-01 disclosing four vulnerabilities in AVEVA Pipeline Integrity Monitor — industrial SCADA software widely used to manage pipeline operations across the energy and utilities sectors. All versions up to 2025_SP1_P1 are affected. AVEVA has released the 2025 SP1 P2 Security Update as the remediation.
What the Vulnerabilities Do
The advisory covers four CVEs (CVE-2026-81821 through 81824) with severity ranging from medium to high. The two highest-severity flaws carry a CVSS score of 8.4:
CVE Summary — ICSA-26-253-01
- CVE-2026-81821 (CVSS 8.4) — Hardcoded cryptographic key in the PIMBoards component. An attacker with access to affected project files can decrypt sensitive configuration and operational data without any credentials.
- CVE-2026-81822 (CVSS 8.4) — MD5 used for password hashing. MD5 is computationally weak and allows offline brute-force attacks against stored credentials once an attacker gains access to the database.
- CVE-2026-81823 (CVSS 6.5) — Authorization bypass allowing lower-privileged users to access operations restricted to administrators.
- CVE-2026-81824 (CVSS 5.4) — Reflected cross-site scripting (XSS) enabling injection of malicious scripts via the web interface.
Why This Matters for OT Teams
Hardcoded cryptographic keys are a chronic problem in industrial software: they cannot be rotated, and once the key is extracted from a binary or a support document, every installation using that version is compromised. In the context of pipeline SCADA, this means an adversary who reaches the network segment and obtains project files can silently reconstruct operational parameters — set points, valve configurations, flow thresholds — without triggering any authentication event.
The MD5 credential flaw compounds this risk. Modern GPU-based cracking can exhaust MD5 hashes of common industrial passwords in minutes. Combined with the authorization bypass (CVE-2026-81823), an attacker can escalate from a low-privileged account to full administrative control of the pipeline management interface.
CISA notes that Pipeline Integrity Monitor is deployed globally in oil and gas transmission, water distribution, and district heating networks — all classified as critical infrastructure under the National Infrastructure Protection Plan.
Recommended Actions
AVEVA's advisory prescribes three immediate steps:
- Upgrade to 2025 SP1 P2. This is the only complete fix. The update replaces the hardcoded key, migrates password storage to a modern hashing algorithm, and patches the authorization and XSS flaws.
- Rotate all PIMBoards user passwords after upgrading. Existing MD5 hashes stored pre-patch should be considered compromised if the system was network-accessible.
- Apply network segmentation. Restrict access to the Pipeline Integrity Monitor server to authorised engineering workstations only, using IEC 62443 zone and conduit controls. No direct internet-facing exposure.
If immediate patching is not feasible during an active operational window, CISA recommends compensating controls: restrict network access at the firewall level, enable enhanced logging on the PIMBoards server, and monitor for anomalous authentication events. Integrating OT-specific monitoring tools (Dragos, Claroty, Nozomi) with your SOC provides visibility into protocol-level anomalies that standard IT firewalls miss.
For organisations looking to build secure IIoT integration layers and custom SCADA data pipelines with proper secrets management — avoiding the hardcoded-key pattern by design — YuSMP Group delivers industrial software development with built-in security practices.
Sources: CISA ICS Advisory ICSA-26-253-01 (Sep 10, 2026); AVEVA Security Update 2025 SP1 P2 release notes.