CVE-2025-7639: AVEVA Enterprise SCADA Deserialization of Untrusted Data

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-09-29
Weakness: CWE-502

Description

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".

Affected products

AVEVA Enterprise SCADA: from 2024 through 2024 SP1 P01; from 2023 through 2023 SP1; from 2022 through 2022 SP2 P2; through 2021 SP2 P5; 2025
AVEVA Enterprise SCADA HMI: through 2023_P1; 2024, 2024 R2

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-225-01.json
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-005.pdf
https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-01

Get alerted when CVE-2025-7639 or the next vulnerability affects your stack