# Hard-coded Keys and Broken Crypto: AVEVA's Pipeline Monitor Exposes Critical Infrastructure to Credential Theft and Browser Attacks


## The Threat


Four vulnerabilities in AVEVA's Pipeline Integrity Monitor — software used to manage and visualize pipeline operations at facilities worldwide — create a combined attack surface that ranges from offline credential cracking to live browser exploitation. The flaws were disclosed this week in CISA advisory AVEVA-2026-006, and they affect every version of the product up through the most recent service pack.


The most structurally troubling issue is CVE-2026-81821: AVEVA shipped PIMBoards with a hard-coded cryptographic key embedded in the software itself. Any operator or contractor with read access to PIMBoards project files — a group that's often larger than it should be in plant environments — can decrypt sensitive configuration data without any special tooling. Hard-coded keys aren't a configuration mistake; they're a design flaw that requires a patch and a migration to fix, not a policy adjustment.


Layered on top of that is CVE-2026-81822, which reveals that the same project files store user passwords as weak, computationally reversible hashes. An attacker who gets the files can run offline brute-force attacks and recover credentials — potentially including administrator accounts. The remaining two CVEs add missing authorization controls (CVE-2026-81823) and a stored or reflected XSS vector (CVE-2026-81824) that allows arbitrary JavaScript execution inside a PIMBoards browser session. Together, these aren't four isolated bugs; they're a credential-theft-to-privilege-escalation-to-session-hijack chain.


## Severity and Impact


| CVE | CVSS v3.1 | CVSS v4.0 | Vector String (v3.1) | CWE | Impact |

|---|---|---|---|---|---|

| CVE-2026-81821 | 8.4 HIGH | 8.3 HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CWE-321 | Decrypt sensitive data via hard-coded key |

| CVE-2026-81822 | 8.4 HIGH | 8.3 HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N | CWE-327 | Brute-force weak password hashes; elevate to admin |

| CVE-2026-81823 | HIGH | — | Local access, low complexity | CWE-862 | Missing authorization; unauthorized function access |

| CVE-2026-81824 | HIGH | — | Network-accessible | CWE-79 | XSS enabling arbitrary code in browser session |


Attack complexity is rated Low across the board. The local access vector for CVE-2026-81821 and CVE-2026-81822 should not be read as "low risk" — in OT environments, read access to project files is commonly held by engineering workstations, shared network drives, and backup systems that aren't treated as security assets.


## Affected Products


  • AVEVA Pipeline Integrity Monitor — all versions up to and including 2025_SP1_P1_build_7.1.9580.8513

    • - Includes all associated PIMBoards project files created on affected versions

    - Worldwide deployment; sectors include Critical Manufacturing and energy/pipeline infrastructure


    AVEVA notes that PIMBoards project files created in older versions carry the vulnerability even after the host software is patched, because the weak cryptographic material is baked into the file format itself.


    ## Mitigations


    Primary remediation:


    1. Apply AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update — this is the only complete fix. The update changes the password hashing algorithm and introduces end-user managed encryption keys.


    2. Migrate all PIMBoards project files to the new format immediately after patching. Migration is one-way and irreversible — old-format files cannot be re-opened in the new version, so operators must plan this transition carefully.


    For files that cannot be migrated (backups, archived copies, transient files on shared drives):

  • Audit and tighten read access controls on any file system location where PIMBoards project files are stored or copied
  • Treat these files as if they contain plaintext credentials until properly disposed of

    • Mandatory post-patch action:

  • Force a password reset for all PIMBoards users. Any password stored in an old-format project file should be considered compromised regardless of whether exploitation is confirmed.

    • Network-level mitigations (defense-in-depth):

  • Restrict browser-based access to PIMBoards to known, managed engineering workstations to reduce XSS exposure
  • Apply network segmentation consistent with ICS/OT best practices — PIMBoards instances should not be reachable from general corporate networks

    • Full details are in AVEVA security bulletin AVEVA-2026-006.


    ## References


  • AVEVA Security Bulletin AVEVA-2026-006: [https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf](https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf)
  • CISA ICS Advisory (AVEVA Pipeline Integrity Monitor): [https://www.cisa.gov/news-events/ics-advisories/](https://www.cisa.gov/news-events/ics-advisories/)
  • NVD entries: CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824

    • ---


    ## HackWire Analysis


    The detail worth dwelling on here is the one-way migration. AVEVA's fix requires operators to permanently convert their PIMBoards project files to the new format — there's no rollback path. In IT environments, that kind of constraint is annoying. In OT environments running 24/7 production processes, it's a real operational planning event that will cause some facilities to delay patching longer than they should.


    That delay calculus is exactly what attackers in the ICS space have learned to exploit. The pattern is consistent: vendors release a patch with a non-trivial migration or downtime requirement, operations teams defer to the next scheduled maintenance window, and the exposure window stretches from weeks into months. The hard-coded key in CVE-2026-81821 is particularly damaging in this scenario — any project files copied to backup systems, engineering laptops, or shared drives in the interim should be treated as containing readable credentials. The patch doesn't retroactively fix those files.


    The XSS vulnerability (CVE-2026-81824) is the one that should get more attention than it likely will. Pipeline integrity monitoring software increasingly runs in browser-based interfaces accessed from shared engineering workstations, sometimes across facilities. A successful XSS payload in that environment isn't just a session cookie grab — it's potential access to whatever industrial data PIMBoards is authorized to display, and possibly a foothold on a workstation connected to the process network.


    Organizations running AVEVA software in pipeline or critical manufacturing environments should treat this as an urgent patch, map every location where PIMBoards project files exist, and force password resets before anyone asks them to. Don't wait for the next maintenance window.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)