A user with nothing more than ordinary access to an Ignition dashboard could hand themselves the keys to the whole industrial control server, according to an advisory published by CISA on October 13. The flaw, tracked as CVE-2026-92817, affects Inductive Automation's Ignition platform and carries a CVSS v3.1 score of 8.8 (high), or 8.7 under CVSS v4.
Ignition is software that factories, utilities and other operators use to build the screens and control logic that sit between people and physical equipment, often described as SCADA or HMI software. CISA lists the affected sectors as Critical Manufacturing, Energy and Information Technology, with deployments worldwide. That makes a privilege escalation on the Ignition server more than an IT problem: the gateway is where industrial projects live and run.
A dashboard session that unlocks the designer
The bug sits where two parts of Ignition meet: Vision and Perspective, its modules for building operator screens, and Designer-level access, the rights used to edit projects.
According to CISA, the Perspective module does not properly validate session privileges when it decides who gets Designer-level access. An authenticated user who has access to a Vision project can present their valid Vision session identifier and be granted Designer-level privileges. From there, CISA says, an attacker could execute arbitrary code in the context of the Ignition Gateway process. The weakness is classed as CWE-863, incorrect authorization.
The important limit is that the attacker needs a valid login first. This is not a bug that lets a stranger on the internet walk in. But in plants where many operators, contractors or integrators hold low-level accounts, or where one of those accounts has been phished or reused, the gap between "can view a screen" and "can run code on the server" is exactly the kind of step an intruder looks for.
Affected versions
- Ignition 8.1.0 through 8.1.54
- Ignition 8.3.0 through 8.3.8
The vulnerability was reported to Inductive Automation by researcher Tim Hemingway. CISA says no known public exploitation specifically targeting the flaw has been reported to it.
Upgrade to 8.1.55 or 8.3.9
Inductive Automation has released Ignition 8.1.55 and 8.3.9 to address the issue, and recommends users move to the newest version available. The vendor's Trust Center carries its own write-up. Operators who cannot upgrade immediately should review which accounts hold Vision project access and remove any that are not needed.
CISA also repeats its standard advice for industrial systems: keep control system devices off the public internet, put control networks behind firewalls and separate them from business networks, and when remote access is unavoidable, use a VPN that is itself kept fully patched. That last point is not a throwaway line this week, after attackers exploited an Ivanti VPN zero-day before a fix was available.
Ignition joins a run of recent flaws in industrial management software, including a myPRO Manager bug that needed no password at all. This one needs a login, which buys defenders time, but only if they spend it upgrading.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.