AVEVA has patched four vulnerabilities in Pipeline Integrity Monitor that could let an attacker read encrypted project data, crack user passwords, or hijack a browser session.
AVEVA's Pipeline Integrity Monitor, used by pipeline operators worldwide, shipped project files protected by a hard-coded encryption key (CVE-2026-81821) and passwords hashed with a broken algorithm (CVE-2026-81822). Anyone with read access to those files could decrypt secrets outright, and separately, could brute-force the weak password hashes, potentially climbing to a PIMBoards administrator account. A missing-authorization bug (CVE-2026-81823) let unauthenticated users pull read-only data, and a cross-site scripting flaw (CVE-2026-81824) let an attacker run JavaScript in a victim's browser if tricked into clicking a malicious link. All four affect versions through 2025 SP1 P1 build 7.1.9580.8513.
PIM software tracks pipeline integrity data for critical manufacturing operators, so the two high-severity flaws (CVSS 8.4 apiece) matter less for their exploit mechanics and more for what they reveal about how the product handled secrets: baking an encryption key into the software and hashing passwords weakly are textbook mistakes, not novel attack techniques. The fix isn't a simple patch either: migrating old project files to the new hashing scheme is one-way, and every PIMBoards user has to reset their password.
CISA's advisory doesn't mention active exploitation, but hard-coded keys and weak hashes are the kind of low-effort findings that show up in industrial software audits far more often than they should.