Remote Code Execution Vulnerability in AVEVA's Model Application Server
CVE-2025-61937

10CRITICAL

Key Information:

Vendor

Aveva

Status
Process Optimization
Vendor
CVE Published:
16 January 2026

What is CVE-2025-61937?

This vulnerability allows unauthenticated attackers to execute arbitrary code with system privileges under the 'taoimr' service in AVEVA's Model Application Server. If exploited, it could lead to a complete compromise of the server, exposing sensitive data and allowing further attacks on connected systems. Immediate action is necessary to mitigate this risk and protect your infrastructure.

Affected Version(s)

Process Optimization 0 <= 2024.1

References

https://www.aveva.com/en/support-and-success/cyber-securi...
https://softwaresupportsp.aveva.com/en-US/downloads/produ...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-0...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christopher Wu of Veracode reported these vulnerabilities to AVEVA.
.