PIMBoards CVE-2026-81822

Exploitation requires local read access to PIMBoards project files on the host or shared storage where application data is stored (AV:L, PR:L per CVSS 4.0 vector). This vulnerability is not directly reachable over a network without a prior host compromise or file-share misconfiguration. Brute-force success after hash extraction depends on the undisclosed specific algorithm weakness and individual user password strength - weaker passwords are cracked faster. Only app-native PIMBoards credentials are at risk; accounts authenticated solely through an external identity provider would not expose crackable hashes. No user interaction is required once read access to project files is established (UI:N).

The CVSS 4.0 score of 8.3 accurately reflects a high subsequent-system impact (SC:H/SI:H) driven by the admin-escalation chain, but the local access prerequisite (AV:L, PR:L) meaningfully constrains the realistic threat pool to insiders, users with overly permissive file share access, or attackers with an existing OT host foothold. Even a mid-sized pipeline operator in opole managing a modest PIM deployment should treat this as a near-term patching priority, given the sensitivity of pipeline integrity data and the fact that admin compromise can affect all users and audit records within the application. No CISA KEV listing is present and no POC has been disclosed, suggesting exploitation has not been observed at scale. EPSS data was not provided. The practical brute-force barrier depends on the undisclosed hash algorithm strength and individual password quality, introducing residual uncertainty about exploitation speed - this uncertainty does not reduce remediation urgency but does suggest that enforcing strong passwords is a meaningful interim control.

An attacker with read access to the PIMBoards host - via a compromised OT workstation, overly permissive network file share, or malicious insider - copies the project files containing stored password hashes. Using offline cracking tools such as Hashcat against the weak hash algorithm, the attacker recovers plaintext credentials for one or more PIMBoards users, then authenticates directly as a PIMBoards administrator, gaining full control over pipeline integrity records and application configuration.