VulnHub

Real-time Cybersecurity News

AVEVA Enterprise SCADA

All CISA Advisories
PhishingCVEVulnerability

Overview

A vulnerability has been identified in AVEVA Enterprise SCADA that could allow attackers to manipulate serialized data, potentially leading to code execution during deserialization. This issue affects multiple versions of the software, including Enterprise SCADA 2025 and earlier versions back to 2022. Users are advised to switch from 'Binary Formatter' to 'Json' serialization and to change the 'AcceptBinaryFormattedData' setting to 'false'. Additionally, AVEVA recommends auditing device permissions and ensuring that only trusted users have operator rights. While there are no reports of active exploitation of this vulnerability, organizations are urged to take defensive measures to protect their systems. For detailed remediation steps, users should refer to the relevant knowledge base articles provided by AVEVA.

Key Takeaways

  • Affected Systems: AVEVA Enterprise SCADA 2025, Enterprise SCADA 2024, Enterprise SCADA 2023, Enterprise SCADA 2022
  • Action Required: Change 'Mode' setting from 'Binary Formatter' to 'Json'; change 'AcceptBinaryFormattedData' setting from 'true' to 'false'; re-cache the XOS Event Handlers assembly; configure clients to only use JSON serialization; migrate HMI displays; audit devices and permissions; disallow BLT Test clients in production environments.
  • Timeline: Disclosed on 2026-08-13

Original Article Summary

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization. The following versions of AVEVA Enterprise SCADA are affected: Enterprise SCADA 2025 (CVE-2025-7639) Enterprise SCADA >=2024|=2023|=2022|=2024|=2023|=2022| "Mode" setting from 'Binary Formatter' to 'Json'. Change "BinarySerializer" -> "AcceptBinaryFormattedData" setting from 'true' to 'false'. Re-cache the XOS Event Handlers assembly Mitigation Client Components: Configure clients/products that interface with Enterprise SCADA to only use JSON serialization. Mitigation HMI: Migrate HMI displays Mitigation For step-by-step instructions on where and how to apply these configuration settings, how to migrate HMI displays, compatible server-client versions list, and additional details please refer to KB117814 "AVEVA Midstream Product Bulletin - Removal of Binary Formatter" https://softwaresupportsp.aveva.com/en-US/knowledge/details/000117814?lang=en_US Mitigation AVEVA recommends the following general defensive measures: Audit devices, network topology, and perimeter defences to ensure all applicable security best practices from AVEVA's Enterprise SCADA Reference System Architecture are adhered to. Audit assigned permissions to ensure that only trusted users are given "DNA Authority - Operator" rights: https://docs.aveva.com/bundle/scada-ent-2025/page/651008.html Disallow BLT Test clients in production environmentsFor additional details on defensive measures, refer to Section 5 of KB117814 "AVEVA Midstream Product Bulletin - Removal of Binary Formatter https://docs.aveva.com/bundle/scada-ent-2025/page/651008.html Mitigation For more information on this vulnerability, including security updates, users should see the security bulletin AVEVA-2026-005. https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-005.pdf Relevant CWE: CWE-502 Deserialization of Untrusted Data Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.1 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H 4.0 6.1 MEDIUM CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments AVEVA reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks. Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity. Revision History Initial Release Date: 2026-08-13 Date Revision Summary 2026-08-13 1 Initial Republication of AVEVA security bulletin AVEVA-2026-005 Legal Notice and Terms of Use

Impact

AVEVA Enterprise SCADA 2025, Enterprise SCADA 2024, Enterprise SCADA 2023, Enterprise SCADA 2022

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on 2026-08-13

Remediation

Change 'Mode' setting from 'Binary Formatter' to 'Json'; change 'AcceptBinaryFormattedData' setting from 'true' to 'false'; re-cache the XOS Event Handlers assembly; configure clients to only use JSON serialization; migrate HMI displays; audit devices and permissions; disallow BLT Test clients in production environments.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, CVE, Vulnerability.

Read Original Article

Related Coverage

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The Hacker News

A credential-theft campaign named GhostAction has recently intensified, affecting around 1,900 GitHub accounts. This attack, observed by GitGuardian on October 8 and 9, 2026, targeted over 30,000 repositories linked to approximately 3,000 users and organizations. The attackers aimed to extract sensitive information, specifically 3,174 secrets from public repositories' Continuous Integration (CI) systems. This incident raises significant concerns for developers and organizations using GitHub, as compromised accounts can lead to unauthorized access and potential data breaches. Users are advised to secure their accounts and monitor their repositories for any suspicious activity.

Oct 15, 2026

UK Legal Aid Agency: Hackers stole records dating back to 1978

BleepingComputer

In April 2025, the UK's Legal Aid Agency (LAA) experienced a significant data breach where hackers accessed and stole sensitive records dating as far back as 1978. This breach is concerning as it compromises the personal and legal information of individuals who relied on the Public Defender Service over decades. The stolen records may include sensitive data that could be used for identity theft or fraud. The LAA, which operates under the Ministry of Justice, is now facing scrutiny over its cybersecurity measures and the potential risks to the public. This incident underlines the importance of robust security practices, especially for agencies handling sensitive information.

Oct 15, 2026

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

The Hacker News

A serious security vulnerability has been identified in Langflow, an open-source platform for developing AI applications. This flaw, tracked as CVE-2026-105740, has a high severity rating of 9.9, indicating it poses a significant risk to users. According to a report by Previdian, attackers have already made 1,423 attempts to exploit this vulnerability in honeypot systems. The flaw allows for authenticated remote code execution, which means that if successfully exploited, attackers could run arbitrary code on affected systems. Given Langflow’s use in various AI projects, this vulnerability could have wide-ranging implications for developers and organizations relying on the platform. Users should prioritize patching and securing their installations to mitigate potential attacks.

Oct 15, 2026

EU Grocers Pay a Steep Price for Unpatched Fridge Firmware

darkreading

A number of grocery stores across the European Union faced significant financial losses due to outdated firmware in their cooling systems. These stores had outsourced management of their operational technology (OT) to third-party vendors, who failed to update the firmware, leaving the systems vulnerable. As a result, hundreds of stores reported losses amounting to millions of dollars. This incident serves as a stark reminder of the risks associated with neglecting firmware updates, especially in critical systems like refrigeration that directly impact food safety and inventory management. Companies must prioritize regular updates and maintenance to avoid similar costly failures in the future.

Oct 15, 2026

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

The Hacker News

Ahsay Backup, based in Singapore, has released security updates to fix two vulnerabilities in their AhsayCBS software, identified as CVE-2026-105133 and CVE-2026-105134. These flaws have been exploited by attackers to install web shells and XMRig cryptocurrency miners on compromised systems. The vulnerabilities allow unauthorized access and execution of arbitrary commands, making them particularly dangerous. Users of AhsayCBS should apply the latest patches immediately to protect their systems from these exploits, which have already been seen in the wild. The situation underscores the need for continuous monitoring and updating of software to defend against evolving threats.

Oct 15, 2026

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

BleepingComputer

Palo Alto Networks has identified a serious vulnerability in its PAN-OS, labeled CVE-2026-0322, which allows for remote code execution (RCE). This flaw is particularly concerning as it has already been exploited in attacks focusing on their firewall products. Users of Palo Alto's firewalls are at risk, as attackers can potentially gain unauthorized access and control over affected systems. To address this issue, Palo Alto Networks has issued security updates, urging users to apply them promptly to safeguard their networks. This incident highlights the ongoing challenges organizations face in securing their infrastructure against emerging cyber threats.

Oct 14, 2026