CVE-2025-61937
published 2026-01-16CVE-2025-61937: The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service…
PriorityP275critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
1.51%
71.2th percentile
The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” service, potentially resulting in complete compromise of the model application server.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aveva | process_optimization | < 2025 | 2025 |
| aveva | process_optimization | <= 2024.1 | — |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cgc9-hp86-4fr7: The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” serv
ghsa_unreviewed·2026-01-16
CVE-2025-61937 [CRITICAL] CWE-94 GHSA-cgc9-hp86-4fr7: The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” serv
The vulnerability, if exploited, could allow an unauthenticated
miscreant to achieve remote code execution under OS system privileges of
“taoimr” service, potentially resulting in complete compromise of the model application server.
CISA ICS
AVEVA Process Optimization
cisa_ics·2026-01-15·CVSS 10.0
[CRITICAL] AVEVA Process Optimization
ICS Advisory
##
AVEVA Process Optimization
Release DateJanuary 15, 2026
Alert CodeICSA-26-015-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could enable an attacker to execute remote code, perform SQL injection, escalate privileges, or access sensitive information.
The following versions of AVEVA Process Optimization are affected:
- Process Optimization (CVE-2025-61937, CVE-2025-64691, CVE-2025-61943, CVE-2025-65118, CVE-2025-64729, CVE-2025-65117, CVE-2025-64769)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 10
| AVEVA
| AVEVA Process Optimization
| Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elem
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-015-01.jsonhttps://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d85-4fde-ac11-5239e87a68eahttps://www.aveva.com/en/support-and-success/cyber-security-updates/https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01
2026-01-16
Published