AVEVA Enterprise SCADA Insecure Deserialization Vulnerability (CVE-2025-7639/ICSA-26-225-01)

Vulnerability Overview Vulnerability Name: AVEVA Enterprise SCADA Publication Date: August 13, 2026 Alert Code: ICSA-26-225-01 Related Topics: Industrial Control System Vulnerability, Industrial Control System CVSS Score: 3.7 Vulnerability Description: Successful exploitation of this vulnerability may allow an attacker to manipulate serialized data, resulting in code execution during deserialization. Affected Versions Affected Versions: - Enterprise SCADA 2025 (CVE-2025-7639) - Enterprise SCADA >=2024 - Enterprise SCADA >=2023 - Enterprise SCADA >=2022 - Enterprise SCADA <=2021_SP2_P5 (CVE-2025-7639) - Enterprise SCADA HMI 2024 - Enterprise SCADA HMI <=2023_P1 (CVE-2025-7639) Critical Infrastructure Sector: Critical Manufacturing Deployment Region: Global Company Headquarters Location: United Kingdom Remediation Recommended Practices: - CISA recommends users take defensive measures to minimize the risk of this vulnerability being exploited. - Organizations should conduct appropriate impact analysis and risk assessment before deploying defensive measures. - CISA also provides a section on recommended practices for control system security, available at cisa.gov/ics. - Organizations should implement recommended cybersecurity strategies to proactively defend ICS assets. - Additional mitigation guidance and recommended practices are publicly available in the CISA technical information document ICS-TIP-12-146-01B. - Organizations should follow internal procedures to report suspicious malicious activity and report to CISA for tracking and correlation analysis. - CISA also recommends users take the following steps to protect themselves from social engineering attacks: Do not click links or open attachments in unsolicited email messages. Additional Information Vulnerability Number: CVE-2025-7639 Acknowledgement: AVEVA reported this vulnerability to CISA. Revision History: - Initial Publication Date: August 13, 2026 - Revision 1: August 13, 2026, Initial Publication of AVEVA Security Advisory AVEVA-2026-005 Tags Industry: Critical Manufacturing Topics: Industrial Control System Vulnerability, Industrial Control System Related Advisories Siemens License Server (SLS) ANDRITZ HIPASE-250 and 250 SCALA Haiwell IoT Cloud HMI Gateway Hitachi Energy APM Edge Product Legal Notices and Terms of Use This product is subject to these notices and privacy and usage policies. Vendor Vendor: AVEVA Share Your Thoughts We have recently updated our anonymous product survey and welcome your feedback. Back to Top Back to top link Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security About CISA: Budget and Performance, OIG.gov, FOIA Requests Cyber Civil Rights Initiative (Cyber Civil Rights Act): Office of the Inspector General, Privacy Policy, Subscribe White House: USA.gov, Website Feedback --- The above is a summary of the key information about the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

AVEVA Enterprise SCADA Insecure Deserialization Vulnerability (CVE-2025-7639/ICSA-26-225-01)

More from this source