Skip to main content

CISA issues alert on AVEVA Application Server IDE vulnerability

Source Decision Insights Threat Desk Published November 27, 2025 Companies 1
Human View Machine View

346th article in the last 90 days, one of 456 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues alert on Mitsubishi Electric MELSEC iQ-F Series vulnerability (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
Which to buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / Software / Design & Creative Software

Our classification, not the publisher's statement. Best suited for, not only for.

AVEVA's Application Server IDE contains a vulnerability that permits injection of malicious scripts, posing risks related to script-based attacks.

The issue affects Application Server versions up to 2023 R2 SP1 P02. This weakness allows an authenticated user with the “aaConfigTools” privilege to modify application objects' help files during configuration within the IDE component, enabling persistent script injection that can escalate privileges horizontally or vertically. The vulnerability is identified as CVE-2025-8386 and is scored 6.9 under Common Vulnerability Scoring System (CVSS) v3.1, with a vector indicating low attack complexity and required privileges. Under CVSS v4, the base score is 7.2 with specified vector metrics. Runtime components remain unaffected.

Exploitation of this vulnerability could lead to unauthorized alteration of help files and execution of injected scripts, resulting in escalation of user privileges.

Updates that address this vulnerability are available in AVEVA System Platform version 2023 R2 SP1 P03 and subsequent releases. Users are advised to install these updates to remediate the issue.

AVEVA recommends that organizations assess the vulnerability in the context of their operational environment and apply security updates accordingly. Organizations should audit permissions to restrict membership in the “aaConfigTools” Operating System (OS) group to trusted users. Further security guidance includes minimizing network exposure of control systems, isolating such systems behind firewalls separate from business networks, and employing secure remote access methods such as updated Virtual Private Networks. Organizations are encouraged to conduct impact analyses and risk assessments before implementing defenses and to adhere to recommended cybersecurity practices and mitigation strategies published by appropriate authorities.

Blog post, originally published by CISA at cisa.gov.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-application-server-ide-vulnerability/",
        "name": "CISA issues alert on AVEVA Application Server IDE vulnerability",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-application-server-ide-vulnerability/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@type": "Organization",
      "name": "AVEVA"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure",
      "Data Center"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / Software / Design & Creative Software"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:20:35-06:00",
    "datePublished": "2025-11-27T13:30:26-07:00",
    "description": "AVEVA Application Server IDE has an XSS vulnerability in versions up to 2023 R2 SP1 P02; updating to 2023 R2 SP1 P03 mitigates the risk.",
    "headline": "CISA issues alert on AVEVA Application Server IDE vulnerability",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "CISA"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-317-02"
    },
    "keywords": [
      "Application",
      "Common Vulnerability Scoring System",
      "Operating System",
      "Server",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-aveva-application-server-ide-vulnerability/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages