The vulnerability arises from a missing authorization check that permits an unauthenticated user to perform operations reserved for Simulator Instructor or Simulator Developer roles. This allows the attacker to modify simulation parameters, training configuration, and training records, thereby compromising the integrity of the training data and potentially using the system as a foothold for further compromise.

AVEVA Pipeline Simulation 2025 is impacted. All released versions before SP1 P01 (build 7.1.9580.8513) contain the flaw. The vendor recommends upgrading to AVEVA Pipeline Simulation 2025 SP1 P01 or any newer build to resolve the issue.

The CVSS score of 9.3 indicates a high‑severity flaw and, with an EPSS score not available, the risk remains significant. The vulnerability is listed as not in the KEV catalog. The likely attack vector is via unauthenticated remote connections to the Pipeline Simulation Server API, as suggested by the recommended defensive measures to restrict network access to trusted client systems. Exploitation would result in unauthorized privilege escalation, allowing the attacker to tamper with simulation settings and potentially disrupt or falsify training outcomes.