Vulnerabilities
AVEVA SCADA bug lets an operator run code as DNA Apps
CVE-2025-7639, CVSS 7.1, lets an AVEVA Enterprise SCADA operator tamper with serialized data and run code as the higher-privileged DNA Apps group.
AVEVA Enterprise SCADA and its HMI (human machine interface) client have a deserialization flaw, CVE-2025-7639, rated CVSS 7.1. A user who already holds the "DNA Authority - Operator" role, one specific tier within AVEVA's own permission system, can tamper with serialized data the application trusts, and get the application to run code under "DNA Apps", a broader security group with more reach than a plain operator should have. CISA published the advisory, ICSA-26-225-01, on August 13, 2026, based on a report from AVEVA itself.
This is not a story about an internet-facing zero-day. It needs a working account first, and CISA says no exploitation has been reported. It matters anyway because Enterprise SCADA runs pipeline and utility control rooms, where "operator" is a normal, widely held login, and this flaw turns that ordinary account into something with the run of a higher-privileged application group. If your plant, pipeline or utility runs Enterprise SCADA or Enterprise SCADA HMI, read on before your next patch window.
How it works
SCADA (supervisory control and data acquisition) software is what lets a control room operator watch and command physical equipment, pumps, valves, breakers, remote sensors, from a screen instead of walking out to the equipment. Enterprise SCADA traces back to Telvent's OASyS DNA platform, later owned by Schneider Electric and now AVEVA, and DNA there stood for Dynamic Network of Applications, which is why its permission groups are still named "DNA Authority" and "DNA Apps" today.
Deserialization is how a program turns a saved or transmitted stream of bytes back into a live object it can work with, the reverse of writing that object out to disk or across a network. Enterprise SCADA does this with the .NET Binary Formatter, a serializer Microsoft has warned against for years because it does not check that the bytes it is about to rebuild came from a trusted, unmodified source. If an attacker can alter that byte stream before it is deserialized, the object that comes back is not the harmless one the code expected. It can carry instructions that run the moment the deserializer builds it.
That is the shape of CVE-2025-7639 (CWE-502, deserialization of untrusted data). An authenticated user holding "DNA Authority - Operator", one specific role in AVEVA's own permission scheme, sits below the "DNA Apps" security group in AVEVA's model, but can tamper with serialized objects the application deserializes, and the resulting code execution happens with DNA Apps privilege. An attack complexity rating of "high" in the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H) means an attacker has to line up conditions beyond simply having the account, but the account itself is the only door that has to be open.
What attackers are doing
CISA states plainly that "no known public exploitation specifically targeting this vulnerability has been reported to CISA at this time." AVEVA found and reported the issue itself rather than a researcher or an incident spotting it in the wild, and its EPSS score, a measure of how likely a flaw is to be exploited soon, sits at 0.33 percent, in the 26th percentile of scored vulnerabilities. Treat this as a patch-on-schedule bug, not a drop-everything one, unless your environment already has reason to distrust who holds operator accounts.
What to do
1. Patch to a fixed version
AVEVA's fixed server versions are v2025 P1 or higher, v2024 SP1 P2, v2023 SP1 P1, v2022 SP2 P3 and v2021 SP2 P6. Fixed HMI client versions are v2024 R2 HF7 or higher, v2024 P1 and v2023 P2 HF1. Match the fixed version to the release line you already run rather than jumping to the newest one, since AVEVA's compatibility matrix in KB117814 governs which server and client builds can talk to each other.
2. Turn off Binary Formatter after patching
The patch alone does not close the door. AVEVA also asks you to change the "BinarySerializer" Mode setting from Binary Formatter to Json, and set AcceptBinaryFormattedData to false, on both servers and clients, then re-cache the XOS Event Handlers assembly for the change to take effect. Any third-party client or integration that talks to Enterprise SCADA needs to be reconfigured to use JSON serialization too, or it will stop working once binary formatted data is refused. KB117814 walks through the exact settings path.
3. If you cannot patch today
CISA's advisory repeats the standard guidance for these systems: audit your network topology and perimeter so that Enterprise SCADA servers and HMI clients are not reachable from the corporate IT network or the internet, following AVEVA's own Enterprise SCADA Reference System Architecture. Separately, audit who holds "DNA Authority - Operator" rights and remove it from any account that does not need it, since that membership is the one precondition this flaw requires. CISA also says to disallow BLT Test clients, a diagnostic client type, in production environments.
4. Check for signs of tampering
Review Enterprise SCADA and HMI audit and security logs for two things: changes to DNA Authority role membership, especially additions to the Operator tier, made outside a change window or by an account that should not be managing permissions, and deserialization errors or exceptions logged around the same unexpected times. Separately, list the members of the DNA Apps security group and confirm every account there was added through your own change process. An account that appeared in DNA Apps without a matching operator-tier change request is the pattern this flaw would leave behind.
The wider lesson
This is a story about a permission boundary inside a system, not a perimeter. An HMI operator seat is usually handed to a shift worker with a badge, already inside the plant network, which is exactly why it gets less scrutiny than a domain admin account does. A role that can reach a broader privilege group through a code path nobody audits is the OT equivalent of a service account with more rights than the job needs, and it deserves the same review a domain admin group gets in a corporate directory.
Our network penetration tests check whether OT and SCADA systems are actually isolated from corporate IT and the internet the way your architecture assumes, and our attack surface management work keeps that boundary and its exposed services under continuous watch as the network changes. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: CISA ICS advisory ICSA-26-225-01, Strix CVE-2025-7639 detail, CyberStrike CVE-2025-7639 detail.