CVE-2026-1495
Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent
02 Description
Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 0.13% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 2.2% of scored records. A rank, not a probability.
- NVD base score
- 5.7 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Deferred. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-02-10 20:18Z8 MO AGO
- Last updated
- 2026-02-12 18:46Z8 MO AGO
- Reserved
- 2026-01-27
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.7)
- CNA CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:L
- Weaknesses
- CWE-532Insertion of Sensitive Information into Log FileBase
- Data version
- 5.2
- Document digest
- bddbf793bd05ae4bdac1c6e463a0712e28b45a7f736d0706bf451cb167b672a8
05 Affected products
06 References
07 Remediation
AVEVA recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. * Users of affected product versions should apply security updates to mitigate the risk of proxy details exposure in newly generated PI to CONNECT Agent event logs. * Users who have used affected product versions, should review existing PI to CONNECT Agent event logs (live/backups/copies) for exposed proxy connection details and consider purging the sensitive data from logs and/or configuring new credentials for access to the proxy service. The following general defensive measures are recommended: * Remove use of plain text passwords in proxy URLs. Alternatively, if passwords are required by the proxy, then use least-privilege credentials. * Ensure only trusted users are given Event Log Reader (S-1-5-32-573) privileges on hosts where PI to CONNECT is installed. * Review existing PI to CONNECT event logs (live/backups/copies) for exposed proxy connection details and consider purging the sensitive data from logs and/or configuring new credentials for access to the proxy service. All affected versions can be fixed by upgrading to PI to CONNECT Agent v2.5.2790 or higher. The latest version of the agent can be downloaded from the CONNECT Data Services Portal here: [ https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-003.pdf .