Advisories › Inductive Automation › ICSA-26-246-06
Inductive Automation Ignition: 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in Inductive Automation Ignition. Weakness type: Incorrect Default Permissions. Successful exploitation of this vulnerability could allow any authenticated user to create projects. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
What to do: Prioritize: Inductive Automation recommends users upgrade to 8.1.54 or later (or the latest 8.3 version), which restricts project creation to Designer sessions and no longer relies on this setting.
Why this matters for oil & gas: Inductive Automation Ignition is a popular SCADA/HMI platform in oil & gas; Affected products include Ignition.
At a glance
- Vendor
- Inductive Automation
- Products
- Ignition
- CVEs
- CVE-2026-77393
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-77393 | Incorrect Default Permissions | 8.8 | – | No | In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. |
Affected products (1)
- Inductive Automation Ignition: <=8.1.53
Vendor fixes and mitigations (from advisory)
- Mitigation: Inductive Automation has determined that this issue is a default-value configuration, not a flaw in the access control itself. The security control enforces exactly what the "Create Project Role(s)" setting specifies; because the setting shipped blank, no role was required to create a project. Populating the setting fully closes the vulnerability.
- Mitigation: Inductive Automation recommends users upgrade to 8.1.54 or later (or the latest 8.3 version), which restricts project creation to Designer sessions and no longer relies on this setting. Users who must remain on an earlier 8.1 version can fully remediate the issue by setting "Create Project Role(s)" to match their Designer Role. Once the setting is populated, only users holding that role can create projects. See Gateway General Security Settings. link
- Mitigation: For more information, see the publication at the Inductive Automation Trust Center. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.