CISA warns of privilege escalation vulnerability in Inductive Automation Ignition
A security vulnerability in Inductive Automation Ignition software allows authenticated users to escalate privileges and execute arbitrary code on industrial automation systems.
FTMQ Security, written by our newsroom0 views
The Cybersecurity and Infrastructure Security Agency released an alert on October 13, 2026, regarding a privilege escalation vulnerability in Inductive Automation Ignition software. CISA Alerts reported that successful exploitation permits an authenticated low-level user to gain higher access rights on the platform. [1]
According to CISA Alerts, the flaw is tracked as CVE-2026-92817. The vulnerability stems from the Ignition Perspective module failing to properly validate session privileges when checking for Designer-level access. An authenticated user with access to a Vision project can submit a valid Vision session identifier to obtain Designer-level privileges. [1]
Inductive Automation is an industrial automation software provider based in Folsom, California. The Ignition SCADA platform serves as the primary product line for the company. [2]
CISA Alerts noted that affected software versions include Ignition versions 8.1.0 through 8.1.54, as well as versions 8.3.0 through 8.3.8. An attacker who successfully elevates privileges through this flaw can execute arbitrary code within the context of the Ignition application. [1]
In short
- CVE-2026-92817 affects Inductive Automation Ignition versions 8.1.0 to 8.1.54 and 8.3.0 to 8.3.8.
- The Ignition Perspective module fails to properly validate session privileges for Designer-level access.
- Authenticated low-level users can exploit the flaw to execute arbitrary code.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Inductive Automation Ignition SoftwareCISA Alerts, 13h ago (the report this story comes from)
Background
- [2]Inductive Automation on Wikipedia
Our newsroom writes these reports with the help of software, from the 2 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Microsoft Patches High Severity Privilege Escalation Flaw in Exchange ServerTop Stories, 8d ago
- Critical Ghostscript vulnerability allows remote code execution through malicious PDF filesTop Stories, 1h ago
- High severity NVIDIA DCGM Exporter vulnerability threatens internet exposed GPU serversCybercrime and Scams, 4d ago
More in Threat Intelligence
- Swann security cameras contain authentication flaws allowing unauthorized video access1h ago
- European bank suffers months of unauthorized VPN access through vendor1h ago
- Japan declares first cyberspace emergency following severe automated ransomware attacks1d ago
- Hackers abuse custom GPTs to execute ClickFix malware attacks1d ago
- AvisLoader Windows Malware Uses Peer to Peer Network to Resist Disruption1d ago
- US Offers Ten Million Dollar Reward for Alleged Hafnium Hacker4d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.