Deserialization Vulnerability in AVEVA's DNA Apps
CVE-2025-7639

10CRITICAL

Key Information:

Vendor

Aveva

Status
Aveva Enterprise Scada
Aveva Enterprise Scada Hmi
Aveva Pipeline Operations For Gas/liquids
Aveva Pipeline Integrity Monitor (delivered On Pipeline Simulation Media)
Vendor
CVE Published:
14 August 2026

What is CVE-2025-7639?

An authenticated attacker with 'DNA Authority - Operator' privileges may exploit this vulnerability to tamper with serialized data. This manipulation can lead to code execution during deserialization under the authority of the Enterprise SCADA security group, potentially jeopardizing the integrity and security of affected systems.

Affected Version(s)

AVEVA Enterprise SCADA 2025

AVEVA Enterprise SCADA 2024 <= 2024 SP1 P01

AVEVA Enterprise SCADA 2023 <= 2023 SP1

References

https://www.aveva.com/content/dam/aveva/documents/support...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AVEVA reported this vulnerability to CISA.
.