Inductive Automation Ignition
CISA reports a permissions flaw (CVE-2026-77393, CVSS 8.8) in Inductive Automation Ignition <=8.1.53 letting authenticated users create projects; fixed in 8.1.54.
CISA republished Inductive Automation's advisory for CVE-2026-77393, an incorrect default permissions issue (CWE-276) in Ignition 8.1.53 and earlier. The Gateway "Create Project Role(s)" setting shipped blank, allowing any authenticated user who can execute gateway scripts to create projects. Ignition 8.1.54 restricts project creation to Designer sessions and the 8.3 series is unaffected. CISA notes no known public exploitation of this vulnerability.
- CVSS 3.1 base score of 8.8 (HIGH) with network vector and low privileges required
- Fix: upgrade to Ignition 8.1.54 or use the unaffected 8.3 series
- CISA recommends isolating control systems and minimizing internet exposure
- No public exploitation reported to CISA at this time
- CVEs
- CVE-2026-77393
- Vendors
- Inductive AutomationCISA
- Products
- Ignition
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77393 | Incorrect default permissions in Inductive Automation Ignition 8.1 allow unauthorized project creation | 8.7 | <1% |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow any authenticated user to create projects. The following versions of Inductive Automation Ignition are affected: Ignition <=8. 1.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.