The vulnerability is caused by an uncaught exception in AVEVA PI Data Archive that an unauthenticated attacker can trigger to force a crash of core PI services, resulting in a denial-of-service condition. This flaw is identified by CWE‑248 and manifests as an unhandled error pathway that causes an abrupt termination of critical data archive processes. The impact is a loss of availability for the PI system, potentially disrupting data collection, storage, and real‑time monitoring in industrial control environments.

The affected product is AVEVA PI Data Archive. All versions of PI Data Archive delivered by PI Server can be remediated by upgrading to PI Server 2024 R2 or later. For installations running PI Server 2018 SP3 Patch 7 or earlier, a fix is available by upgrading to PI Server 2018 SP3 Patch 8 or higher.

This flaw has a high severity CVSS score of 8.7 and a low EPSS probability (< 1 %), indicating that while exploitation is technically possible, it is not widespread at present and is not listed in the CISA KEV catalog. The attack vector is remote and does not require authentication; an adversary would need to send a crafted request that triggers the uncaught exception, which then crashes the service. Because the vulnerability exists in a process exposed over the network (notably port 5450), an attacker can initiate the exploit without privileged access, making rapid exploitation of the flaw a practical concern for operators of exposed PI servers.