AVEVA warns of code-execution flaw in Enterprise SCADA software used across pipelines and manufacturing

Key points

• AVEVA disclosed CVE-2025-7639, a high-severity flaw in its Enterprise SCADA software, on 13 August 2026 through a CISA advisory.
• The bug carries a CVSS v3.1 score of 7.1 and could let an authenticated operator run code inside the control system.
• Every supported release from 2021 through 2025, plus the HMI client, is affected; AVEVA has issued fixed builds for all of them.
• No public exploitation has been reported, and the vulnerability has high attack complexity.
• Fully closing the hole requires both installing the patch and switching a serialization setting from Binary Formatter to JSON.

AVEVA, the British industrial software vendor owned by Schneider Electric, has told customers to patch its Enterprise SCADA product after finding a flaw that could let an insider run their own code on the systems that monitor pipelines, factories and other industrial plant.

SCADA, short for Supervisory Control and Data Acquisition, is the software that operators sit in front of to watch and steer physical equipment: valves on a gas line, motors in a plant, pumps at a water facility. AVEVA's Enterprise SCADA is widely deployed in the oil and gas midstream sector and in critical manufacturing worldwide.

The bug is tracked as CVE-2025-7639 and was published in a CISA advisory on 13 August 2026 alongside AVEVA's own security bulletin AVEVA-2026-005.

What is actually broken?

The software mishandles serialized data, which is data packaged up for storage or transport and later unpacked by the program. An attacker who already has an operator account can slip a doctored package into the system, and when the server unpacks it, the attacker's code runs.

In technical terms this is a deserialization of untrusted data flaw, catalogued as CWE-502. It scores 7.1 out of 10 on the CVSS v3.1 severity scale, which AVEVA rates as high but not critical, partly because the attacker needs a valid "DNA Authority - Operator" login and partly because the attack is complex to pull off.

Any code that does run executes with the privileges of the "DNA Apps" security group inside Enterprise SCADA, giving the attacker meaningful reach inside the control environment.

Which versions are affected?

Every supported release is affected. AVEVA has published a fixed build for each one.

AVEVA's Pipeline Operations for Gas and Liquids, Pipeline Integrity Monitor, Pipeline Training Simulator and Measurement Advisor products also receive matching updates.

Is patching enough?

No. Installing the update is only step one. To fully close the hole, administrators also need to change a configuration setting on the server: flip "BinarySerializer" from "Binary Formatter" to "Json", set "AcceptBinaryFormattedData" to false, and re-cache the XOS Event Handlers assembly.

Clients that talk to Enterprise SCADA must also be told to use JSON only, and HMI (Human Machine Interface) displays, the graphical screens operators actually look at, need to be migrated. AVEVA's knowledge-base article KB117814 walks through the steps.

Should the public be worried?

Not immediately. There is no known exploitation in the wild, the attacker needs valid operator credentials, and the attack is rated as high complexity. The bigger risk is a rogue insider or an outsider who has already stolen an operator login through phishing, where criminals send fake emails to trick staff into handing over passwords.

AVEVA also advises operators to audit who holds the "DNA Authority - Operator" role and to keep test clients out of production networks.

AVEVA reported the vulnerability to CISA itself, and the fixes are available now through the usual AVEVA support channels.