Inductive Automation Ignition CVE-2026-92817 (CVSS 3.1 8.8 / 4.0 8.7): the Perspective module accepts a Vision session as proof of Designer-level access, so a low-privileged user can run code on the Ignition Gateway; fixed in 8.1.55 and 8.3.9

CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation's Ignition, the SCADA/HMI and industrial application platform. CVE-2026-92817 (CWE-266, incorrect privilege assignment) is in the Perspective module, which does not properly validate session privileges when it decides whether a user has Designer-level access. An authenticated user with access to a Vision project can present their valid Vision session identifier and be granted Designer privileges, then use them to execute arbitrary code in the context of the Ignition Gateway process. Affected: Ignition 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. CISA scores it CVSS v3.1 8.8 and CVSS v4.0 8.7 and lists Critical Manufacturing, Energy and Information Technology as the sectors where Ignition is deployed. Per CISA, Inductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to fix the issue, and recommends updating to the newest version available. The flaw was reported to Inductive Automation by Tim Hemingway. CISA says no known public exploitation specifically targeting this vulnerability has been reported to it. Because the Gateway runs the plant-facing projects, code execution there can reach connected OT systems, so treat Vision project access as a privileged right until patched. Primary: CISA ICSA-26-286-01; vendor: Inductive Automation Trust Center bulletin (its page sits behind a browser check and could not be read for this card); CVE record published 13 October.

Product

Inductive Automation Ignition (Perspective module; Ignition Gateway)

Versions

Affected: 8.1.0–8.1.54 and 8.3.0–8.3.8. Fixed: 8.1.55 and 8.3.9 (per CISA).

CVSS

8.8 (CVSS 3.1); 8.7 (CVSS 4.0) — CISA

Exploited in Australia?

unknown

Patch to

Upgrade Ignition to 8.1.55 or later on the 8.1 line, or 8.3.9 or later on the 8.3 line (newest available recommended). Until then, review who holds Vision project access, keep the Gateway off the internet and behind firewalls separated from business networks, use an up-to-date VPN for remote access, and review Gateway audit logs for Designer sessions from unexpected users.

Primary: CISA — ICSA-26-286-01: Inductive Automation Ignition Software (13 Oct 2026) · Vendor: Inductive Automation Trust Center — CVE-2026-92817 bulletin · CVE: CVE-2026-92817 · CVE.org — CVE-2026-92817 (published 13 Oct 2026, CNA ICS-CERT)

vulnerabilities ot ics