The vulnerability, if exploited, could allow an authenticated miscreant
(OS standard user) to tamper with TCL Macro scripts and escalate
privileges to OS syst…

CVE-2025-64691 is a privilege escalation vulnerability affecting AVEVA software that allows authenticated OS standard users to tamper with TCL Macro scripts. Successful exploitation enables privilege escalation to OS system level, potentially resulting in complete compromise of the model application server. The vulnerability affects industrial control systems and requires authentication but can lead to full system compromise. CISA has issued an advisory (ICSA-26-015-01) regarding this vulnerability. The issue impacts AVEVA's industrial software solutions used in operational technology environments.