Critical AVEVA Software Vulnerabilities Enables Remote Code Execution Under System Privileges

**Executive Summary:** AVEVA disclosed seven vulnerabilities in Process Optimization (<= 2024.1), including a critical unauthenticated API remote code execution (CVE-2025-61937) that permits SYSTEM-level compromise of the taoimr service; other high-severity issues include macro-based code injection, SQL injection granting SQL Server admin access, DLL hijacking, missing ACLs enabling project tampering, and cleartext transmission. AVEVA and CISA coordinated disclosure, and AVEVA recommends immediate upgrade to Process Optimization 2025 or later, restricting taoimr ports (8888/8889), applying strict ACLs, and prioritizing patching to prevent industrial control system compromise.