A vulnerability in AVEVA Process Optimization allows authenticated users to achieve privilege escalation via malicious project file tampering, posing a significant risk of unauthorized access.

This flaw, classified as CWE-862 (Missing Authorization), allows an authenticated user with standard OS privileges to modify project files. By injecting malicious code into these files, an attacker can escalate privileges when an unsuspecting victim user opens or interacts with the compromised project.

The ability for a standard user to escalate privileges represents a critical security failure, potentially granting an attacker full control over the application or the victim's session. With a CVSS score of 8.1, this high-severity vulnerability could lead to significant data compromise, unauthorized lateral movement within the production environment, and potential operational disruption.

Immediate Action: Update all instances of AVEVA Process Optimization to version 2025 or later as specified in the vendor security bulletin AVEVA-2026-001.

Proactive Monitoring: Review access logs for unusual modifications to project file directories and monitor for suspicious process execution patterns initiated by standard user accounts.

Compensating Controls: Implement strict file system permissions to limit write access to project directories and enforce the principle of least privilege for all OS user accounts interacting with the software.

Public Exploit Available: No — exploit_available is false.

Given the potential for privilege escalation and the availability of a vendor-provided patch, organizations must prioritize upgrading to version 2025 immediately. Failure to address this vulnerability increases the risk of internal actors or compromised accounts gaining unauthorized administrative control over critical process optimization workflows.