A patch can close a software flaw without making the files it used to protect safe. That is the uncomfortable detail in the new AVEVA Pipeline Integrity Monitor bulletin. The vendor has fixed four vulnerabilities in its PIMBoards component, but it also tells customers to migrate old project files, protect copies they cannot migrate and require users to change passwords. Teams that stop at the software installer may leave the most durable part of the exposure behind.

AVEVA's 8 September security bulletin covers Pipeline Integrity Monitor 2025 SP1 P1, build 7.1.9580.8513, and earlier versions. The bulletin gives a date but no publication time. It directs users to the 2025 SP1 P2 security update or later. The affected component is PIMBoards. The bulletin reports no known exploitation or victims. It also makes no claim of disrupted pipeline operations.

Two findings concern the project files themselves. CVE-2026-81821 is a hardcoded encryption key: someone who can read an affected PIMBoards project file may be able to decrypt sensitive information inside it. CVE-2026-81822 concerns passwords hashed with MD5. A person with read access to an affected project file could try to recover a PIMBoards user's application password by offline guessing, potentially gaining that user's privileges. AVEVA rates both 8.3 under CVSS 4.0. The bulletin does not describe either as a standalone remote break-in. The attacker first needs a project file.

The other two findings involve the application interface. CVE-2026-81823 is missing authorisation on a subset of read-only API methods. AVEVA says an unauthenticated requester could perform reads intended…