CVE-2026-81823

Summary

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.

Affected Software

Weaknesses

• CWE-862: CWE-862: Missing Authorization

Workarounds

AVEVA recommends the following general defensive measures:

• Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the PIMBoards API to ensure that only trusted client systems are permitted to establish connections.
• Apply strong Access Control Lists to all folders storing project files to ensure only trusted users have read-access.
• Maintain a trusted chain-of-custody on project files during creation, modification, distribution, backups, and use.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-253-01
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-253-01.json

• ←Previous
• Next→