CVE-2026-81824: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in AVEVA Pipeline Integrity Monitor

This vulnerability is an instance of CWE-79, improper neutralization of input during web page generation, leading to cross-site scripting in AVEVA Pipeline Integrity Monitor. Exploitation involves tricking a PIMBoards user into clicking a malicious link, which then executes arbitrary JavaScript code in their browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, no confidentiality, integrity, or availability impact, but with high scope and high security impact on integrity.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, unauthorized actions, or information disclosure within the affected web application. However, no direct impact on system confidentiality, integrity, or availability is indicated. The attack requires user interaction (clicking a malicious link).

No official patch or remediation is currently available for this vulnerability. Users and administrators should exercise caution with links received from untrusted sources to avoid social engineering attacks. Monitor vendor advisories for updates regarding patches or official fixes.