CISA republishes AVEVA advisory on SCADA flaw tied to CVE-2025-7639

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA republished an AVEVA security bulletin on Aug. 13 warning that a deserialization flaw in AVEVA Enterprise SCADA and related HMI products could allow code execution if abused by an authenticated attacker.

CISA republished an AVEVA security bulletin on Aug. 13 warning that CVE-2025-7639 affects AVEVA Enterprise SCADA and related HMI products and could let an authenticated attacker tamper with serialized data and potentially trigger code execution during deserialization.

CISA said the products are used in critical manufacturing environments, are deployed worldwide and that AVEVA reported the vulnerability to the agency.

What CISA said is affected

CISA listed AVEVA Enterprise SCADA 2025; Enterprise SCADA versions 2024, 2024_SP1_P01, 2023, 2023_SP1, 2022, 2022_SP2_P2, and 2021_SP2_P5; and AVEVA Enterprise SCADA HMI 2024|2024|R2 and 2023_P1 and earlier as known affected.

The advisory identifies the issue as CWE-502, or deserialization of untrusted data. CISA assigned the flaw a CVSS 3.1 score of 7.1, marked high, and a CVSS 4.0 score of 6.1, marked medium.

CISA said successful exploitation could allow an attacker to tamper with serialized data and potentially achieve code execution during deserialization. The bulletin also says an authenticated user with

This is the AMP version of the article. Read the full article on Atlas Watchline.