CVE-2025-61943

An authenticated application user (Standard User) can inject malicious data into queries directed to the Captive Historian component by exploiting a flaw in input data validation. Manipulated SQL queries are executed in the context of a SQL Server administrator account. As a result, an attacker can execute arbitrary commands at the privilege level of the database administrator account, which classifies the vulnerability as RCE.

An attacker can gain full control over the SQL Server instance, including the ability to read, modify and delete data, as well as execute system commands through database mechanisms (e.g., xp_cmdshell). The consequence may be complete compromise of the database server and process data.

Apply patches available from the vendor according to references — update described in the Aveva support portal (softwaresupportsp.aveva.com) and in CISA advisory ICSA-26-015-01. It is recommended to restrict access to the Captive Historian component only to trusted users and to monitor SQL Server account activity.

Aveva Process Optimization (versions indicated in vendor references — advisory ICSA-26-015-01)