This vulnerability (CVE-2026-5387) in AVEVA Pipeline Simulation 2025 involves missing authorization checks (CWE-862), enabling an unauthenticated attacker to perform privileged operations intended only for Simulator Instructor or Simulator Developer roles. The attacker could modify critical simulation and training data, potentially impacting the integrity of simulation environments. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity. No patch or official remediation level is currently available, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to escalate privileges and perform administrative operations, including modification of simulation parameters, training configurations, and training records. This could compromise the integrity and reliability of the simulation environment and associated training processes. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected system and monitor for unauthorized activity related to simulation and training configurations. Avoid exposing the affected software to untrusted networks where possible.