Successful exploitation of this vulnerability, discovered by researcher Tim Hemingway, could allow an authenticated low-level user to escalate their privileges to a higher level.
Ignition is an Integrated Software Platform for Supervisory Control and Data Acquisition (SCADA). It can build industrial applications for Human-Machine Interfaces (HMI) and SCADA systems.
The following versions of Inductive Automation Ignition Software suffer from the issue:
- Ignition from version 8.1.0 up to and including 8.1.54
- Ignition from version 8.3.0 up to and including 8.3.8
In the vulnerability, the Ignition Perspective module does not properly validate session privileges when determining designer-level access. An authenticated user with access to a vision project could provide their valid vision session identifier and gain designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition gateway process.
2026-92817 is the case number for the vulnerability, which has a CVSS V3 base score of 8.8. There is also a V4 base score of 8.7.
The product sees use in the critical manufacturing, energy, and information technology sectors. It also sees action on a global basis.
No exploit currently targets this vulnerability.
In terms of mitigations, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September this year to address this issue. Users should update to the newest version available.
For more information, see the publication at the Inductive Automation Trust Center.