Inductive Automation Ignition Software
CISA warns Ignition CVE-2026-92817 lets authenticated users gain Designer access and run code.
64
Vulnerability4 · 3 reads
CVE-2026-92817
Privilege escalation to RCE in Ignition Perspective
- CVSS 4.0
- 8.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-92817 is an incorrect-authorization flaw in the Inductive Automation Ignition Perspective module. An authenticated user who already has access to a Vision project can supply a valid Vision session identifier that is not properly checked, and thereby obtain Designer-level privileges. Those elevated privileges can be used to run arbitrary code in the Ignition Gateway process, with high impact to confidentiality, integrity, and availability of that Gateway. Industrial sites running Ignition with Vision and Perspective are in scope; specific affected version ranges are not stated in the provided data. It is not listed in CISA KEV and no public proof-of-concept is known.
What to do: Apply the vendor fix from Inductive Automation or the CISA ICS advisory as soon as it is available for your Ignition Gateway, and restrict which accounts can open Vision projects. Until patched, keep the Gateway off the public internet, limit Vision session use to trusted users, and review Gateway logs for unexpected Designer-level actions or code execution.
| Product | Affected |
|---|---|
| Inductive Automation Ignition (Perspective module / Vision session access to Designer privileges) | — |
Estimated exposure
moderateOn the order of 1,000–10,000 internet-exposed Gateways, plus more internal sites — Ignition is widely deployed industrial HMI/SCADA software rather than a consumer product; public internet scans have historically found on the order of thousands of exposed Gateways, with a larger but uncounted set of internal plant…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
- Weakness
- CWE-863
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X