CVE-2025-65117
Aveva Process Optimization ≤ 2025
Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-65117 is a high-severity Use of Potentially Dangerous Function (CWE-676) vulnerability in Aveva Process Optimization. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-65117, published on 2026-01-16, is a privilege escalation vulnerability (CWE-676) with a CVSS v3.1 base score of 7.4 (AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N). It affects AVEVA Process Optimization Designer, where an authenticated Process Optimization Designer User can embed OLE objects into graphics, enabling potential privilege escalation upon victim interaction with those elements.
The attack requires local access, low complexity, high privileges (Process Optimization Designer User authentication), and user interaction from a victim. A miscreant can craft graphics containing embedded OLE objects; when a higher-privileged victim user subsequently interacts with the graphical elements, the attacker escalates to the victim's identity, achieving high impacts on confidentiality and integrity with a changed scope but no availability disruption.
Advisories including CISA ICSA-26-015-01, AVEVA cybersecurity updates, and related software support downloads provide mitigation guidance and patches for this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2992
Vulnerability Data
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis directly locate calls to unsafe functions.
Documented standards and tools can explicitly disallow dangerous functions during development.
Engineering principles can mandate safe APIs and ban dangerous functions at design time.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding or safely wrapping dangerous functions during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can surface instances of dangerous functions but does not prevent their introduction.
Developer security awareness training can teach safe alternatives to risky functions.
Secure SDLC processes include code review and static analysis that can detect use of risky functions.
Secure coding standards explicitly ban or restrict dangerous functions such as strcpy, gets, or system.
Controlled software installation reduces exposure to unsafe third-party libraries that may contain dangerous calls.