Aveva Application Server vulnerabilities

2 CVEs affecting Aveva Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-8386, published 2025-11-15.

More from Aveva.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-7113, published 2024-08-13. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack.
• CVE-2025-8386, published 2025-11-15. Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days. The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection…