PatchTheCVEaveva vulnerabilities
Recent CVEs affecting aveva products. 8 tracked.
aveva has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-01-16. Highest priority: CVE-2025-61937 (score 61/100).
- CVE-2025-65118 HIGH 8.8 UPGRADE The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process O
- CVE-2025-65117 HIGH 7.4 UPGRADE The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User)
- CVE-2025-64769 HIGH 7.1 UPGRADE The Process Optimization application suite leverages connection channels/protocols that by-default are not en
- CVE-2025-64729 HIGH 8.1 UPGRADE The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Pro
- CVE-2025-64691 HIGH 8.8 UPGRADE The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL
- CVE-2025-61943 HIGH 8.4 UPGRADE The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User)
- CVE-2025-61937 CRITICAL 10.0 UPGRADE The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution un
- CVE-2024-3467 HIGH 7.8 DOWNGRADE There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the
FAQ
How do I fix aveva vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is aveva being exploited right now?
None of the tracked aveva CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which aveva CVE should I patch first?
CVE-2025-61937 currently ranks highest (61/100): The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution un.