CVE-2026-5387

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5387", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-04-01T21:04:13.517Z", "datePublished": "2026-04-15T15:24:15.623Z", "dateUpdated": "2026-04-15T17:38:50.678Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-15T15:24:15.623Z"}, "title": "AVEVA Pipeline Simulation Missing Authorization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862", "type": "CWE"}]}], "affected": [{"vendor": "AVEVA", "product": "Pipeline Simulation 2025", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2025 SP1 (build 7.1.9497.6351)", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations\u00a0intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations&nbsp;intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records."}]}], "references": [{"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf"}, {"url": "https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "workarounds": [{"lang": "en", "value": "AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their\u00a0operational environment, architecture, and product implementation. Customers using affected product versions should apply security updates to mitigate the risk of exploit.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their&nbsp;operational environment, architecture, and product implementation. Customers using affected product versions should apply security updates to mitigate the risk of exploit."}]}, {"lang": "en", "value": "The following general defensive measures are recommended:\n\u2022 Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the Pipeline Simulation Server API to ensure that only trusted Pipeline Simulation client systems are permitted to establish connections.\n\u2022 Enforce Secure Communication: Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of manipulator-in-the-middle (MitM) attacks and tampering with data in transit.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The following general defensive measures are recommended:<br>\u2022 Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the Pipeline Simulation Server API to ensure that only trusted Pipeline Simulation client systems are permitted to establish connections.<br>\u2022 Enforce Secure Communication: Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of manipulator-in-the-middle (MitM) attacks and tampering with data in transit."}]}], "solutions": [{"lang": "en", "value": "All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher:\nhttps://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f", "supportingMedia": [{"type": "text/html", "base64": false, "value": "All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher:<br>https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f"}]}], "source": {"advisory": "ICSA-26-106-04, AVEVA-2026-004", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:38:40.210058Z", "id": "CVE-2026-5387", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:38:50.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5387", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T17:38:40.210058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:38:43.814Z"}}], "cna": {"title": "AVEVA Pipeline Simulation Missing Authorization", "source": {"advisory": "ICSA-26-106-04, AVEVA-2026-004", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AVEVA", "product": "Pipeline Simulation 2025", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025 SP1 (build 7.1.9497.6351)"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher:\nhttps://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f", "supportingMedia": [{"type": "text/html", "value": "All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher:<br>https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f", "base64": false}]}], "references": [{"url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf"}, {"url": "https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json"}], "workarounds": [{"lang": "en", "value": "AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their\u00a0operational environment, architecture, and product implementation. Customers using affected product versions should apply security updates to mitigate the risk of exploit.", "supportingMedia": [{"type": "text/html", "value": "AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their&nbsp;operational environment, architecture, and product implementation. Customers using affected product versions should apply security updates to mitigate the risk of exploit.", "base64": false}]}, {"lang": "en", "value": "The following general defensive measures are recommended:\n\u2022 Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the Pipeline Simulation Server API to ensure that only trusted Pipeline Simulation client systems are permitted to establish connections.\n\u2022 Enforce Secure Communication: Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of manipulator-in-the-middle (MitM) attacks and tampering with data in transit.", "supportingMedia": [{"type": "text/html", "value": "The following general defensive measures are recommended:<br>\u2022 Restrict Network Access: Implement host-based and/or network firewall controls on all nodes hosting the Pipeline Simulation Server API to ensure that only trusted Pipeline Simulation client systems are permitted to establish connections.<br>\u2022 Enforce Secure Communication: Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of manipulator-in-the-middle (MitM) attacks and tampering with data in transit.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations\u00a0intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations&nbsp;intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-04-15T15:24:15.623Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5387", "state": "PUBLISHED", "dateUpdated": "2026-04-15T17:38:50.678Z", "dateReserved": "2026-04-01T21:04:13.517Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-04-15T15:24:15.623Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Pipeline Simulation 2025", "vendor": "AVEVA", "versions": [{"lessThanOrEqual": "2025 SP1 (build 7.1.9497.6351)", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations\u00a0intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records."}, {"lang": "es", "value": "La vulnerabilidad, si se explota, podr\u00eda permitir a un malhechor no autenticado realizar operaciones destinadas \u00fanicamente a los roles de Instructor de Simulador o Desarrollador de Simulador (Administrador), lo que resultar\u00eda en una escalada de privilegios con potencial para la modificaci\u00f3n de par\u00e1metros de simulaci\u00f3n, configuraci\u00f3n de entrenamiento y registros de entrenamiento."}], "id": "CVE-2026-5387", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5387", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T17:38:40.210058Z", "version": "2.0.3"}}]}, "published": "2026-04-15T16:16:39.007", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025 SP1 (build 7.1.9497.6351)]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Pipeline Simulation 2025", "source": "cna", "vendor": "AVEVA"}, "product": "pipeline_simulation_2025", "vendor": "aveva"}], "analysis": {"en": {"generated_at": "2026-04-15T22:21:22.971347+00:00", "value": {"mitigation_remediation": ["Upgrade to AVEVA Pipeline Simulation 2025\u202fSP1\u202fP01 (build\u202f7.1.9580.8513) or later to apply the vendor fix.", "Restrict network access to the Pipeline Simulation Server API by implementing host\u2011based or network firewall controls so that only trusted client systems can establish connections.", "Enable TLS for all API communications and ensure that server certificates are properly managed and protected to reduce the risk of man\u2011in\u2011the\u2011middle attacks."], "summary": {"action": "Patch Immediately", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "AVEVA Pipeline Simulation 2025 is impacted. All released versions before SP1 P01 (build 7.1.9580.8513) contain the flaw. The vendor recommends upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 or any newer build to resolve the issue.", "description_and_impact": "The vulnerability arises from a missing authorization check that permits an unauthenticated user to perform operations reserved for Simulator Instructor or Simulator Developer roles. This allows the attacker to modify simulation parameters, training configuration, and training records, thereby compromising the integrity of the training data and potentially using the system as a foothold for further compromise.", "risk_and_exploitability": "The CVSS score of 9.3 indicates a high\u2011severity flaw and, with an EPSS score not available, the risk remains significant. The vulnerability is listed as not in the KEV catalog. The likely attack vector is via unauthenticated remote connections to the Pipeline Simulation Server API, as suggested by the recommended defensive measures to restrict network access to trusted client systems. Exploitation would result in unauthorized privilege escalation, allowing the attacker to tamper with simulation settings and potentially disrupt or falsify training outcomes."}}}}, "created": "2026-04-15T22:30:16.061792+00:00", "updated": "2026-04-16T09:12:50.161498+00:00", "vendors": ["aveva", "aveva$PRODUCT$pipeline_simulation_2025"]}