CVE-2026-92817: Inductive Automation Ignition Software Incorrect Authorization
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Inductive Automation Ignitionto a version that resolves this vulnerability.Fixed in 8.3.9 - Upgrade
Upgrade
Inductive Automation Ignitionto a version that resolves this vulnerability.Fixed in 8.1.55
Event History
Frequently Asked Questions
Which users should be considered capable of exploiting this issue?
Any authenticated user who has access to a Vision project is in scope. The user does not need pre-existing Designer-level privileges.
What does an attacker need to present to obtain elevated access?
The attacker needs a valid Vision session identifier associated with their access. That identifier can be used to gain Designer-level privileges because session privileges are not properly validated.
What is the practical impact after successful privilege escalation?
The elevated Designer-level privileges can be used to execute arbitrary code in the context of the Ignition Gateway process. This can affect confidentiality, integrity, and availability of the Gateway.