Advisories › Inductive Automation › ICSA-26-286-01
Inductive Automation Ignition Software: 1 CVE, High 8.8
Summary
CISA reports 1 vulnerability in Inductive Automation Ignition. Weakness type: Incorrect Authorization. Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. Highest CVSS v3 score: 8.8 (High), exploitable over the network.
What to do: Prioritize: Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.
Why this matters for oil & gas: Inductive Automation Ignition is a popular SCADA/HMI platform in oil & gas; Affected products include Ignition.
At a glance
- Vendor
- Inductive Automation
- Products
- Ignition
- CVEs
- CVE-2026-92817
- Highest CVSS v3
- 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-92817 | Incorrect Authorization | 8.8 | – | No | The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process. |
Affected products (2)
- Inductive Automation Ignition: >=8.1.0|<=8.1.54
- Inductive Automation Ignition: >=8.3.0|<=8.3.8
Vendor fixes and mitigations (from advisory)
- Mitigation: Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.
- Mitigation: For more information, see the publication at the Inductive Automation Trust Center. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.