PT-2026-33078 · Aveva · Aveva Pipeline Simulation

Published 2026-04-15 · Updated 2026-04-17 · CVE-2026-5387

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions AVEVA Pipeline Simulation (affected versions not specified)

Description An issue exists where unauthenticated network access allows a remote attacker to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles. This leads to privilege escalation, enabling the modification of simulation parameters, training configuration, and training records.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-5387

Affected Products

Aveva Pipeline Simulation

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-5387 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json · Note
• https://twitter.com/aviatrixtrc/status/2045182301626085885 · Twitter Post
• https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-106-04 · Note
• https://aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf · Note
• https://twitter.com/0dayPublishing/status/2044444326449561605 · Twitter Post
• https://twitter.com/CVEnew/status/2044737972625420520 · Twitter Post