CVE-2026-5387 CRITICAL

CVE-2026-5387: AVEVA Pipeline Simulation Missing Authorization

Vendor Aveva
Product Pipeline Simulation 2025
Weakness CWE-862 · Missing authorization
Published April 15, 2026
Last update April 15, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.

Key dates

02Disclosure timeline

April 15, 2026 CVE published
April 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-8658 myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade CVE-2023-2193 Oauth authorization codes do not expire when deauthorizing an oauth2 app CVE-2025-53291 WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerability CVE-2024-56006 WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability CVE-2026-27150 Discourse doesn't ensure guardian check when creating QueryGroupBookmark