The vulnerability, if exploited, could allow an authenticated miscreant
(OS Standard User) to trick Process Optimization services into loading
arbitrary code and escalate privileges to OS System, potentially
resulting in complete compromise of the Model Application Server.
References
| Link | Resource |
|---|---|
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json | Third Party Advisory |
| https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea | Permissions Required |
| https://www.aveva.com/en/support-and-success/cyber-security-updates/ | Vendor Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 | Third Party Advisory US Government Resource |
Configurations
History
22 Jan 2026, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:aveva:process_optimization:*:*:*:*:*:*:*:* | |
| First Time |
Aveva process Optimization
Aveva |
|
| References | () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.json - Third Party Advisory | |
| References | () https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68ea - Permissions Required | |
| References | () https://www.aveva.com/en/support-and-success/cyber-security-updates/ - Vendor Advisory | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01 - Third Party Advisory, US Government Resource |
16 Jan 2026, 02:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-16 02:16
Updated : 2026-01-22 15:13
NVD link : CVE-2025-65118
Mitre link : CVE-2025-65118
CVE.ORG link : CVE-2025-65118
JSON object : View
Products Affected
aveva
- process_optimization
CWE
CWE-427
Uncontrolled Search Path Element