The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to tamper with Process Optimization project files,
embed code, and escalate their privileges to the identity of a victim
user who subsequently interacts with the project files.
References
| Link | Resource |
|---|---|
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json | Third Party Advisory |
| https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea | Permissions Required |
| https://www.aveva.com/en/support-and-success/cyber-security-updates/ | Vendor Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 | Third Party Advisory US Government Resource |
Configurations
History
22 Jan 2026, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Aveva process Optimization
Aveva |
|
| CPE | cpe:2.3:a:aveva:process_optimization:*:*:*:*:*:*:*:* | |
| References | () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json - Third Party Advisory | |
| References | () https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea - Permissions Required | |
| References | () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - Vendor Advisory | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 - Third Party Advisory, US Government Resource |
16 Jan 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-16 02:16
Updated : 2026-01-22 15:15
NVD link : CVE-2025-64729
Mitre link : CVE-2025-64729
CVE.ORG link : CVE-2025-64729
JSON object : View
Products Affected
aveva
- process_optimization
CWE
CWE-862
Missing Authorization