High

Persistent XSS in AVEVA Application Server IDE App Objects help files

IdentifiersCVE-2025-8386CWE-80· Improper Neutralization of…

CVE-2025-8386 is a basic cross-site scripting vulnerability in the AVEVA Application Server IDE affecting Application Server 2023 R2 SP1 P02 and earlier. The issue stems from improper neutralization of script-related HTML tags in a web page, allowing an authenticated user with the aaConfigTools privilege to tamper with App Objects help files and store a persistent XSS payload. When a victim later accesses the modified content during configuration-time operations in the IDE, the injected script executes in that user’s context. The flaw is limited to the IDE/configuration plane of Application Server; run-time components and run-time operations are not affected, and the advisory states the issue is not remotely exploitable.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows persistence of malicious script content in App Objects help files within the IDE. If a victim user executes the injected content, the attacker may achieve horizontal or vertical privilege escalation in the configuration environment, potentially gaining access to functions or data available to the victim user. The advisory does not indicate direct impact on run-time operations, but confidentiality, integrity, and limited availability impacts are possible within the affected IDE/configuration context.

Mitigation

If you can’t patch tonight, do this now.

Restrict membership of the aaConfigTools OS group to trusted users only and audit existing permissions to remove unnecessary access. Because exploitation is limited to configuration-time IDE operations, reducing the number of users with aaConfigTools privileges materially lowers exposure. Consistent with CISA ICS guidance, minimize network exposure of control system devices, keep them off the public internet, segment control networks from business networks, place systems behind firewalls, and use secure remote access methods such as fully updated VPNs when remote administration is required.

Remediation

Patch, then assume compromise.

Upgrade affected installations to AVEVA System Platform 2023 R2 SP1 P03 or later. AVEVA states that all affected versions of the Application Server IDE can be remediated by applying this update or a higher version. Organizations should apply vendor security updates in accordance with their operational environment, architecture, and implementation constraints.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

3 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2