CVE-2025-65117

low-risk

Published 2026-01-16

The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.

Do I need to act?

0.01% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.4/10 High

LOCAL / LOW complexity

Affected Products (1)

Process Optimization

Affected Vendors

Aveva

References (4)

Third Party Advisory https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-01...

Permissions Required https://softwaresupportsp.aveva.com/en-US/downloads/products/details/a643eaa3-0d...

Vendor Advisory https://www.aveva.com/en/support-and-success/cyber-security-updates/

Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-01

/ 100

low-risk

Severity 23/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal