CVE-2016-8365

lowpriority · track · 22EPSS 0.003 · 28 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.35% (28th) EPSS

CVSS 2.1 · low

Is it mine?

16 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationApplications using PI Asset Framework (AF) Client 2016cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationApplications using PI Software Development Kit (SDK) 2016cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationPI Buffer Subsystemcisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.
MitigationPI Data Archive 2105cisa_csaf_ot
In order to perform the upgrades, users can use the PI AF Client 2016 Install Kit to upgrade PI AF Client and the PI Buffer Subsystem together. Users can use the PI SDK 2016 Install Kit to upgrade the PI SDK. If PI Buffer Subsystem is installed on a machine without PI AF Client, users can use the PI Interface Configuration Utility (ICU) Install Kit (1.4.16.79B) to upgrade buffering without installing the PI AF Client software.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.1–7.1

v2.02.1lowAV:L/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 3.9 · impact 2.9

v3.05.5mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.07.1highCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · CISA US

v3.05.1mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USprimaryCWE-437USCWE-437US

affected products (16)

Products and version ranges known to be affected.

OSIsoft Applications using PI Asset Framework (AF) Client 2016: <2.8.0all versionscisa_csaf_otUS
OSIsoft Applications using PI Software Development Kit (SDK) 2016: <1.4.6all versionscisa_csaf_otUS
OSIsoft PI Buffer Subsystem: <=4.4all versionscisa_csaf_otUS
OSIsoft PI Data Archive 2105: <3.4.395.64all versionscisa_csaf_otUS
OSIsoft Applications using PI Asset Framework (AF) Client 2016< 2.8.0cisa_csaf_otUS
OSIsoft Applications using PI Software Development Kit (SDK) 2016< 1.4.6cisa_csaf_otUS
OSIsoft PI Buffer Subsystem≤ 4.4cisa_csaf_otUS
OSIsoft PI Data Archive 2105< 3.4.395.64cisa_csaf_otUS
OSIsoft PI System software≤ Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6enisa_euvdEU
OSIsoft PI System software≤ PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64.enisa_euvdEU
OSIsoft PI System software≤ Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0enisa_euvdEU
OSIsoft PI System software≤ PI Buffer Subsystem, versions prior to and including, Version 4.4enisa_euvdEU
osisoft pi af client< 2.8.0nvdUScpe:2.3:a:osisoft:pi_af_client:*:*:*:*:*:*:*:*
osisoft pi buffer subsystem< 4.5.0nvdUScpe:2.3:a:osisoft:pi_buffer_subsystem:*:*:*:*:*:*:*:*
osisoft pi data archive< 3.4.400.1162nvdUScpe:2.3:a:osisoft:pi_data_archive:*:*:*:*:*:*:*:*
osisoft pi sdk< 1.4.6nvdUScpe:2.3:a:osisoft:pi_sdk:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-16-313-03OSIsoft PI System Incomplete Model of Endpoint Features Vulnerability2016-08-12icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot nvd NVD CVE.org MITRE

published 2018-04-03modified 2026-06-17

related (13,840)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-81963US	high7.8OT critical	0.39% (33rd)	KEV	2026-09-08
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVE-2026-56290US	critical9.8OT critical	30.9% (98th)	KEV	2026-06-29
Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitra…
CVE-2026-49049US	—OT critical	0.99% (62nd)	Exploit	2026-06-29
The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameter…
CVE-2026-48907US	critical9.8OT critical	85.4% (100th)	KEV	2026-06-05
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
CVE-2026-34908US	—OT critical	88.3% (100th)	KEV	2026-05-22
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

+13835 more

references (9)

External citations — patches, advisories, analysis.

https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03 cnnvd
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00308 cnnvd
https://www.securityfocus.com/bid/94165 cnnvd
http://www.securityfocus.com/bid/94165 enisa_euvd
https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03 enisa_euvd
https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00308 enisa_euvd
http://www.securityfocus.com/bid/94165Third Party AdvisoryVDB Entrynvd
https://ics-cert.us-cert.gov/advisories/ICS-VU-313-03Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan