CVE-2025-64729 HIGH

CVE-2025-64729: AVEVA Process Optimization Missing Authorization

Vendor Aveva
Product Process Optimization
Weakness CWE-862 · Missing authorization
Published January 16, 2026
Last update January 16, 2026

CVSS base score

8.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files.

Key dates

02Disclosure timeline

January 16, 2026 CVE published
January 16, 2026 Record updated