Read the docs
TI-2016-06874 Aliases CVE-2016-8365GHSA-ffjx-jhfg-r39p

Improper access control in OSIsoft PI System software

Priority LOW 25CWE-437Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

Why it matters now

EPSS 0.00348 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OSIsoftPI System softwareApplications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64.—No fix listedCNA
  • PI System software VendorOSIsoft Affected Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64. Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:osisoft:pi_af_client:*:*:*:*:*:*:*:*before 2.8.0VulnerableOSIsoft
cpe:2.3:a:osisoft:pi_buffer_subsystem:*:*:*:*:*:*:*:*before 4.5.0VulnerableOSIsoft
cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:2016:*:*:*before 3.4.400.1162VulnerableOSIsoft
cpe:2.3:a:osisoft:pi_sdk:*:*:*:*:2016:*:*:*before 1.4.6VulnerableOSIsoft
  • cpe:2.3:a:osisoft:pi_af_client:*:*:*:*:*:*:*:* Versions before 2.8.0 Vulnerable ·OSIsoft
  • cpe:2.3:a:osisoft:pi_buffer_subsystem:*:*:*:*:*:*:*:* Versions before 4.5.0 Vulnerable ·OSIsoft
  • cpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:2016:*:*:* Versions before 3.4.400.1162 Vulnerable ·OSIsoft
  • cpe:2.3:a:osisoft:pi_sdk:*:*:*:*:2016:*:*:* Versions before 1.4.6 Vulnerable ·OSIsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8365
  2. 2026-10-03 Alias added: GHSA-ffjx-jhfg-r39p

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences