CVE-2025-65117: Aveva Process Optimization Privilege Escalation

CVE-2025-65117 Overview

CVE-2025-65117 is a privilege escalation vulnerability affecting AVEVA Process Optimization software. The vulnerability allows an authenticated attacker with Process Optimization Designer User privileges to embed OLE (Object Linking and Embedding) objects into graphics. When a victim user subsequently interacts with these malicious graphical elements, the attacker can escalate their privileges to assume the identity of the victim user.

This vulnerability is classified under CWE-676 (Use of Potentially Dangerous Function), indicating that the software relies on functionality that is inherently risky when processing OLE objects within the graphical interface.

Critical Impact

Authenticated attackers can leverage OLE object embedding to hijack victim user sessions and escalate privileges, potentially compromising operational technology (OT) environments running AVEVA Process Optimization.

Affected Products

• AVEVA Process Optimization (all versions prior to patched release)
• Systems with Process Optimization Designer User access enabled
• Industrial control environments utilizing AVEVA Process Optimization for operational workflows

Discovery Timeline

• January 16, 2026 - CVE-2025-65117 published to NVD
• January 22, 2026 - Last updated in NVD database

Technical Details for CVE-2025-65117

Vulnerability Analysis

This vulnerability stems from the use of potentially dangerous functions (CWE-676) in how AVEVA Process Optimization handles OLE object embedding within graphical elements. The attack requires local access and an authenticated user with Process Optimization Designer User privileges, but once positioned, an attacker can craft malicious graphical elements that execute with elevated privileges when interacted with by other users.

The attack leverages the OLE technology's capability to embed executable content within documents and graphics. When a higher-privileged user views or interacts with the poisoned graphical element, the embedded OLE object executes in the context of that user's session, effectively allowing the attacker to perform actions with the victim's credentials and access level.

This is particularly concerning in industrial control system (ICS) environments where AVEVA Process Optimization is deployed, as privilege escalation could grant access to critical operational functions.

Root Cause

The root cause lies in insufficient validation and sandboxing of OLE objects embedded within the Process Optimization graphics subsystem. The application fails to properly restrict what types of OLE objects can be embedded and does not adequately isolate OLE object execution from the viewing user's security context. This use of potentially dangerous OLE embedding functionality without proper safeguards allows authenticated users to craft malicious content that executes with unintended privileges.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access as a Process Optimization Designer User. The attack chain proceeds as follows:

1. The attacker authenticates to the AVEVA Process Optimization system with Designer User credentials
2. The attacker creates or modifies a graphical element, embedding a malicious OLE object
3. The poisoned graphic is saved and made available through normal workflow channels
4. When a victim user with higher privileges views or interacts with the graphic, the OLE object executes
5. The attacker's embedded payload runs with the victim's privilege level, enabling privilege escalation

The vulnerability requires user interaction from the victim, as they must engage with the malicious graphical element for exploitation to succeed. This interaction could be as simple as opening a project file or viewing a dashboard containing the compromised graphic.

Detection Methods for CVE-2025-65117

Indicators of Compromise

• Unusual OLE objects embedded within Process Optimization project files or graphics
• Unexpected process spawning from the AVEVA Process Optimization application context
• User session anomalies where actions are performed inconsistent with user's normal behavior
• Modified graphical elements containing embedded objects that were not part of original designs

Detection Strategies

• Monitor Process Optimization project files for newly embedded OLE objects, particularly from users with Designer privileges
• Implement application-level logging to track graphical element modifications and OLE insertions
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process chains originating from AVEVA applications
• Establish baseline behavior for Designer User accounts and alert on deviations

Monitoring Recommendations

• Enable verbose logging within AVEVA Process Optimization to capture object embedding activities
• Configure SentinelOne agents to monitor for suspicious OLE-related activity patterns in ICS environments
• Implement file integrity monitoring on Process Optimization project directories
• Review access logs regularly for unusual patterns of graphic viewing by privileged users

How to Mitigate CVE-2025-65117

Immediate Actions Required

• Apply the security patch available from AVEVA immediately to all affected installations
• Audit existing Process Optimization projects for suspicious embedded OLE objects
• Review and restrict Designer User privileges to only essential personnel
• Implement network segmentation to limit exposure of Process Optimization systems

Patch Information

AVEVA has released a security update addressing this vulnerability. Organizations should obtain the patched version from the AVEVA Product Download Portal. Additional security guidance is available through the AVEVA Cyber Security Updates page. CISA has also published advisory ICSA-26-015-01 with additional mitigation guidance for industrial control system operators.

Workarounds

• Disable or restrict OLE object embedding capabilities within Process Optimization if business operations permit
• Implement strict access controls limiting which users can modify graphical elements
• Establish review workflows requiring approval before graphical changes are published to production
• Run Process Optimization in isolated network segments with limited user access until patching is complete
• Consider implementing application whitelisting to prevent unauthorized code execution from embedded objects

# Review AVEVA Process Optimization project files for embedded OLE objects
# This example searches for OLE signatures in project directories
find /path/to/aveva/projects -type f \( -name "*.prj" -o -name "*.grf" \) -exec grep -l "OLE" {} \;

# Restrict file permissions on project directories
chmod -R 750 /path/to/aveva/projects
chown -R root:aveva-users /path/to/aveva/projects