CISA has issued an urgent advisory warning that an unauthenticated attacker could remotely crash core data services in AVEVA’s PI Data Archive, a historian widely used in industrial control systems. The flaw, tracked as CVE-2025-44019 and CVE-2025-36539, can be triggered by malformed network input, potentially causing data loss and disrupting process monitoring. Here’s what Windows-based engineering teams must do.
Breaking Down the PI Data Archive DoS Flaw
The heart of the problem, as detailed in CISA advisory ICSA-26-041-03 and AVEVA’s own security bulletin, is an uncaught exception in PI Data Archive subsystems. When a specially crafted packet hits the PI Message Subsystem or related services, the exception forces a process termination—no authentication needed. The attack vector is network-based, typically targeting port 5450, and the complexity is low enough that an attacker doesn’t need deep OT protocol knowledge.
Two CVEs underscore the severity: CVE-2025-44019 and CVE-2025-36539 both carry a high availability impact, meaning a successful exploit knocks the historian offline. Memory-handling weaknesses, likened in some analyses to heap-based buffer faults, raise the ugly possibility that future research could chain these crashes into more intrusive attacks, though no code-execution proof of concept has been made public.
The advisory emphasizes that the vulnerability can be exploited without credentials, though some secondary sources note that certain older PI versions might require low-privilege access. For Windows environments where PI Server often sits on a domain-joined machine, even a locked-down service account could be enough if the endpoint is reachable.
Who’s at Risk and What’s at Stake
Any facility running AVEVA PI Data Archive that hasn’t yet upgraded to the fixed releases is exposed. That includes power plants, water utilities, pharmaceutical manufacturing, and oil refineries—anywhere time-series process data is the lifeblood of operational decisions. If the historian crashes, operators lose visibility into temperature, pressure, flow rates, and asset health. Worse, the PI Data Archive uses in-memory write caches to buffer incoming telemetry. An abrupt service death could wipe out seconds or minutes of uncommitted data, creating gaps in regulatory compliance reports or forensic investigations.
For Windows admins, the impact is twofold: first, the immediate scramble to restore services during an unplanned outage; second, the long-term trust in a data repository that might have gaps. Many PI installations run on Windows Server because AVEVA’s product suite is tightly integrated with Microsoft’s stack—Active Directory authentication, Windows Event Log, and .NET-based PI Web API. That means the same patching rhythms, backup policies, and access controls you apply to Windows servers must now account for industrial process timing.
Patch Now or Mitigate First: A Decision Guide
AVEVA and CISA offer a clear remediation path, but real-world constraints often force a choice between instant patching and short-term hardening. Here’s how to weigh your options.
The Fix Path
| Affected Product | Fixed Release | Notes |
|---|---|---|
| All impacted PI Data Archive versions | Upgrade to PI Server 2024 R2 or later | This is the comprehensive, forward-looking fix. Available through AVEVA’s software support portal. |
| PI Data Archive delivered by PI Server 2018 SP3 Patch 7 and prior | Upgrade to PI Server 2018 SP3 Patch 8 or higher | A stopgap for those who cannot jump directly to 2024 R2. Confirm patch number with AVEVA—some third-party trackers incorrectly state Patch 7. |
Important: The CISA advisory explicitly points to PI Server 2024 R2 (not an earlier 2024 build) and to 2018 SP3 Patch 8. If internal documentation or older bulletins reference different patch numbers, cross-check the exact package name and checksum on the AVEVA customer portal before deployment. The AVEVA security bulletin AVEVA-2026-002 contains authoritative links.
Compensating Controls When Patching Must Wait
If you can’t take the historian offline right away—common in continuous-process industries—CISA recommends these immediate defensive measures:
- Lock down port 5450: Restrict inbound access to trusted engineering workstations, jump boxes, and middleware servers only. Use host-based firewalls or network ACLs. This alone sharply reduces the attack surface.
- Automatic service restart: Configure the PI Message Subsystem and PI Archive Subsystem to restart automatically on failure. This won’t prevent crashes but will minimize manual intervention and downtime. On Windows, this can be set via the Services snap-in under Recovery options.
- Monitor service liveness: Script a watchdog for the processes listed in your installation’s
\PI\adm\pisrvstart.bat. Integrate alerts into your SIEM so that unexpected stops trigger immediate investigation. - Harden jump hosts: Move all PI editing and configuration tasks behind hardened jump hosts with multi-factor authentication and restricted file shares. Automated endpoint protection on any machine that can reach the PI server is non-negotiable.
The Unavoidable Reality of OT Patching
Industrial control systems are notorious for patch lag, and the PI Data Archive sits right at the IT/OT boundary. Engineers often delay upgrades because a historian outage, even planned, can leave operators flying blind. But ignoring these vulnerabilities is riskier: an attacker who crashes the historian during a critical process upset could turn a routine hiccup into a safety incident.
The solution is a staged approach:
- Inventory and map: Document every PI Server, PI Data Archive instance, PI Web API endpoint, and connector in your environment—down to the exact version and service pack number.
- Test in a clone: Spin up a representative test environment that mirrors your production archive sizes, retention policies, and connected clients. Validate that the upgrade to PI Server 2024 R2 (or 2018 SP3 Patch 8) doesn’t break your data flow or existing integrations.
- Schedule maintenance windows with full stakeholder buy-in: Coordinate with operations so they know the historian will be down. If possible, buffer data at the source during the upgrade and replay after services are restored.
- Keep a rollback plan: Have a tested snapshot of your pre-patch system. Know how long restoration would take and whether the upgrade path is reversible—some migrations change on-disk formats permanently.
Many organizations that run PI on Windows already have a mature patch management process for their Windows servers. The key is to treat these AVEVA-specific patches as critical security updates with the same urgency as a Microsoft zero-day.
Looking Forward
AVEVA’s decision to coordinate with CISA and multiple national CERTs signals that industrial software vendors are taking disclosure seriously, but the twin CVEs underscore how fragile critical data infrastructure can be. The fact that an unauthenticated remote DoS exists in a product that underpins FAA-compliant flight data monitoring and pharmaceutical batch records is a wake-up call.
Beyond this advisory, expect AVEVA to continue consolidating security fixes into the PI Server 2024 R2 line and possibly deprecating older branches. For Windows administrators, the lesson is clear: industrial applications must enter the same vulnerability-management cadence as traditional IT systems. Start with these steps:
- Subscribe to AVEVA’s security alerts and CISA’s ICS advisories.
- Audit your PI deployments for exposure—especially any instances accidentally exposed to the internet or corporate LAN.
- Build a relationship with AVEVA support so you can quickly verify patch authenticity when the next bulletin drops.
The window between disclosure and exploitation is shrinking even in OT. A swift response now will buy you the resilience to handle the next set of CVEs.