Loading story…
AVEVA disclosed a critical deserialization of untrusted data vulnerability in Enterprise SCADA tracked as CVE-2025-7639, a remotely exploitable flaw with a CVSS 4.0 score of 10.0. The issue allows an authenticated attacker holding the "DNA Authority - Operator" privilege to tamper with serialized data and potentially trigger code execution during deserialization under the privileges of the "DNA Apps" security group.
The vendor addressed the issue in security bulletin AVEVA-2026-005 and advised organizations to apply available patches and hardening measures. Recommended mitigations include restricting operator privileges and validating serialized data inputs, as the flaw affects industrial control and supervisory environments where compromise of SCADA application privileges could materially increase operational risk.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A critical deserialization of untrusted data vulnerability, CVE-2025-7639, was disclosed for AVEVA Enterprise SCADA. The flaw is rated CVSS 4.0 10.0 and could allow an authenticated attacker with "DNA Authority - Operator" privileges to achieve code execution under the "DNA Apps" security group context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AVEVA disclosed **seven vulnerabilities** in *AVEVA Process Optimization* (formerly *ROMeo*) affecting version **2024.1 and earlier**, including a **CVSS v4.0 10.0** issue, **CVE-2025-61937**, that enables **unauthenticated remote code execution as OS `SYSTEM`**. The flaw is described as a **code injection vulnerability in the application’s API layer** and can allow remote attackers with network access to execute arbitrary code under the `taoimr` service context, potentially leading to full compromise of the **Model Application Server** and connected industrial modeling infrastructure; the attack is characterized as remote, low-complexity, and requiring no user interaction. Additional high-severity issues reported alongside the RCE include **CVE-2025-64691** (macro/TCL script tampering enabling authenticated privilege escalation to `SYSTEM`), **CVE-2025-61943** (SQL injection in the **Captive Historian** component that can lead to SQL Server administrative access and code execution), and other critical/high findings such as **DLL hijacking** (**CVE-2025-65118**), **missing ACLs** (**CVE-2025-64729**), **embedded OLE object** risks (**CVE-2025-65117**), and **cleartext transmission** exposure (**CVE-2025-64769**). AVEVA’s bulletin emphasizes that multiple paths exist to compromise affected servers—either directly via the unauthenticated API RCE or via authenticated user-to-`SYSTEM` escalation—raising immediate risk for organizations operating vulnerable industrial process optimization deployments.
Jun 29, 2026
Advantech WebAccess/SCADA has been found to contain several critical vulnerabilities, including an unrestricted file upload flaw (CVE-2025-14849) and a directory traversal vulnerability (CVE-2025-14850). The unrestricted file upload issue could allow a remote attacker to execute arbitrary code on affected systems, while the directory traversal flaw may enable attackers to delete arbitrary files. Both vulnerabilities are remotely exploitable and have been assigned high CVSS scores, indicating significant risk to organizations using this software in critical infrastructure sectors. CISA has issued an advisory confirming that these vulnerabilities affect Advantech WebAccess/SCADA version 9.2.1, and recommends updating to version 9.2.2 to mitigate the risks. The vulnerabilities impact organizations in sectors such as critical manufacturing, energy, and water and wastewater, with deployments worldwide. Exploitation of these flaws could allow authenticated attackers to read or modify remote databases, potentially leading to severe operational disruptions.
Jun 29, 2026
Public advisories disclosed two **root-level remote code execution** vulnerabilities in **atvise SCADA 3.13.0** from atvise GmbH / Bachmann Visutec, affecting deployments with the `WEBACCESS` module enabled. One flaw allows **pre-authentication** compromise through an **OPC UA authentication bypass** on port `4840`, which can be chained with WebMI script tampering and anonymous request paths to execute arbitrary commands as `root`. The second issue is an **authenticated default-credential RCE** in WebHMI/WebMI, where a built-in `root` account ships with an empty password and a login branch can grant a superuser session without proper password verification while that default state remains. Researchers said successful exploitation can lead to **complete host compromise**, including arbitrary command execution, file access, and manipulation of SCADA control logic and node values. The advisory noted that `WEBACCESS` is normally loaded in licensed production deployments, increasing practical exposure, and said **proof-of-concept code** and full technical analysis were released publicly through Full Disclosure and separate write-ups covering the OPC UA unauthenticated attack path and the WebMI default-credential RCE.
Aug 6, 2026