# Critical Authentication Bypass in AVEVA Pipeline Simulation Poses Risk to Industrial Training Systems
A critical vulnerability in AVEVA Pipeline Simulation could allow unauthenticated attackers to gain unauthorized administrator access and manipulate critical training infrastructure used across the manufacturing and energy sectors worldwide. The flaw, tracked as CVE-2026-5387, carries a CVSS severity score of 9.1 and represents a significant authentication bypass that affects versions released through early 2025.
## The Threat
The vulnerability stems from a missing authorization control in AVEVA Pipeline Simulation's API layer, enabling attackers without valid credentials to perform operations restricted to privileged roles. Specifically, an unauthenticated actor could assume the permissions of both Simulator Instructor and Simulator Developer roles—administrative accounts intended exclusively for system operators and configuration personnel.
An attacker exploiting this flaw could:
The vulnerability requires no user interaction and can be triggered remotely across a network, making it particularly dangerous in interconnected industrial environments. An attacker positioned anywhere with network access to the Pipeline Simulation server could trigger exploitation without authentication credentials or specialized technical knowledge.
## Background and Context
AVEVA develops software solutions for process industries and critical infrastructure, including the widely-deployed Pipeline Simulation tool used for operator training, certification, and scenario rehearsal in oil, gas, and chemical processing facilities. These simulators function as essential components of industrial operations—they train operators on emergency response, process optimization, and safety protocols in controlled environments before they manage actual equipment.
The company, headquartered in the United Kingdom, maintains a significant footprint across critical manufacturing sectors globally. Pipeline Simulation specifically addresses operator competency requirements and regulatory training mandates in jurisdictions where human error in pipeline operations carries severe consequences.
## Technical Details
Vulnerability Classification: The underlying cause involves CWE-862 (Missing Authorization), a common weakness where applications fail to enforce access controls on sensitive operations.
Affected Versions: All builds of AVEVA Pipeline Simulation through version 2025_SP1_build_7.1.9497.6351 remain vulnerable. Organizations running any release up to and including this build should assume exposure.
| Aspect | Details |
|--------|---------|
| CVSS Score | 9.1 (Critical) |
| Attack Vector | Network-based; no local access required |
| Authentication | None required |
| User Interaction | Not required |
| Scope | Unchanged (affects only the vulnerable component) |
| Confidentiality Impact | High (sensitive training data accessible) |
| Integrity Impact | High (modification of training records possible) |
| Availability Impact | None directly reported |
The attack surface is particularly broad because the vulnerability exists in the API layer itself—the interface through which client systems communicate with the Pipeline Simulation server. Any network-connected system that can reach the API endpoint can potentially trigger exploitation, including systems separated from the organization by what administrators believed were adequate network boundaries.
## Implications for Industrial Operations
Pipeline simulation systems serve a dual role in industrial environments: they function as both training platforms and sometimes as planning tools for operations teams. A successful attack could compromise the integrity of training records, potentially invalidating operator certifications and creating liability exposure if an undertrained operator were later involved in an incident. More immediately, an attacker could inject malicious parameters into live training scenarios, causing simulators to behave unpredictably and potentially teaching operators incorrect response procedures.
The worldwide deployment of this software across critical manufacturing infrastructure amplifies the risk. A single exploit could affect multiple organizations simultaneously, and attackers with knowledge of this vulnerability could target multiple facilities to extract training data, modify operational parameters, or establish persistent access for future attacks.
The lack of any reported public exploitation to date should not provide false reassurance—it typically indicates the vulnerability was discovered through responsible disclosure channels before widespread abuse occurred, not that the vulnerability is inherently difficult to exploit.
## Mitigation and Response
Immediate Actions: Organizations using AVEVA Pipeline Simulation should upgrade to build 7.1.9580.8513 (version 2025 SP1 P01) or higher. AVEVA has released this patched version specifically to address this vulnerability. The company provides download and deployment guidance through its software support portal.
Network Isolation: While patches deploy, implement network-based controls to restrict access to Pipeline Simulation servers. Host-based and network firewall rules should ensure only authorized Pipeline Simulation clients can establish connections to the API endpoint. This effectively raises the barrier to remote exploitation even if the underlying vulnerability exists.
Communication Encryption: Enable TLS for all Pipeline Simulation API communications, ensuring that data in transit remains encrypted and authenticated. Properly manage and protect server certificates to prevent man-in-the-middle attacks that could further compromise system integrity.
Broader Defensive Measures: CISA recommends the following practices for control systems and critical infrastructure:
## HackWire Analysis
This vulnerability exemplifies a recurring pattern in industrial software: authentication mechanisms that should enforce absolute access control fail due to insufficient implementation depth. The critical severity rating reflects the ease of exploitation combined with high-impact consequences—unauthenticated access to administrative functions in infrastructure-critical software represents a fundamental security failure.
What's particularly notable is that the vulnerability exists in an API layer, meaning it likely affects not just direct connections to the Pipeline Simulation interface but potentially any system or integration point that communicates with the server through programmatic means. Organizations should conduct discovery to identify all systems and networks with connectivity to affected Pipeline Simulation instances, as the attack surface extends beyond obvious user-facing access points.
The absence of active exploitation should motivate rather than delay patching efforts. This is the window of opportunity to remediate before threat actors develop and distribute exploit code. Given the global deployment of AVEVA software across critical sectors, organizations that delay patching risk becoming targets once exploit details circulate more widely.