CVE-2026-5387: AVEVA Pipeline Simulation Missing Authorization

Published Apr 15, 2026

Updated

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.

Affected Software

1 affected component

AVEVA AVEVA Pipeline Simulation

Remediation

Information

All affected versions can be fixed by upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher: https://softwaresupportsp.aveva.com/en-US/downloads/products/details/57b79fdb-7b5f-4125-8a44-833b6b5c6d6f

Event History

Apr 15, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Nov 28, 58273

Event

via FIRST·12:40 PM

Frequently Asked Questions

What is the severity of CVE-2026-5387?

CVE-2026-5387 is classified as a high severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2026-5387?

To mitigate CVE-2026-5387, ensure that access controls are properly implemented and that unauthorized users are not allowed to perform restricted operations.

What are the potential impacts of CVE-2026-5387?

Exploiting CVE-2026-5387 could allow unauthorized users to perform actions intended for high-level roles, leading to system compromise.

Who is affected by CVE-2026-5387?

CVE-2026-5387 affects users of AVEVA Pipeline Simulation software who do not have proper authorization mechanisms in place.

Is CVE-2026-5387 actively being exploited?

There are currently no public reports confirming active exploitation of CVE-2026-5387, but it remains a serious concern.