Critical severity · published Apr 15, 2026
CVE-2026-5387
AVEVA Pipeline Simulation Missing Authorization
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Pipeline Simulation 2025 · AVEVA
through 2025 SP1 (build 7.1.9497.6351) · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5387
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5387
github.com
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-04.json
softwaresupportsp.aveva.com
https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f
www.aveva.com
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-004.pdf
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04