Inductive Automation Ignition Software
CISA warns Ignition CVE-2026-92817 lets authenticated users gain Designer access and run code.
CISA advisory ICSA-26-286-01 covers CVE-2026-92817 in Inductive Automation Ignition. The Perspective module does not properly check session privileges, so an authenticated user with a valid Vision session can obtain Designer-level access and run arbitrary code as the Ignition Gateway process. Versions 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8 are affected; fixes are 8.1.55 and 8.3.9. CVSS v3.1 is 8.8 and v4.0 is 8.7. CISA says no known public exploitation has been reported. The software is used worldwide in critical manufacturing, energy, and IT.
- CVE-2026-92817 is incorrect authorization in the Ignition Perspective module.
- Authenticated Vision users can gain Designer privileges and execute gateway code.
- Affected builds are 8.1.0–8.1.54 and 8.3.0–8.3.8; fixes are 8.1.55 and 8.3.9.
- CVSS v3.1 is 8.8; CISA reports no known public exploitation.
- CVEs
- CVE-2026-92817
- Vendors
- Inductive Automation
- Products
- Ignition
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92817 | Privilege escalation to RCE in Ignition Perspective | 8.7 | — |
From the original article
3 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. The following versions of Inductive Automation Ignition Software are affected: Ignition >=8. 1.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.