Source: cisa.gov
A high-severity vulnerability (CVE-2026-92817) has been identified in Inductive Automation Ignition Software affecting versions 8.1.0-8.1.54 and 8.3.0-8.3.8. The flaw resides in the Ignition Perspective module, which fails to properly validate session privileges when determining Designer-level access. An authenticated low-privilege user with access to a Vision project can supply their valid Vision session identifier to gain Designer-level privileges, enabling arbitrary code execution in the context of the Ignition Gateway process. The vulnerability is classified as CWE-863 Incorrect Authorization, with a CVSS v3.1 score of 8.8 (HIGH). It impacts critical infrastructure sectors including Critical Manufacturing, Energy, and Information Technology. Patches are available via Ignition versions 8.3.9 and 8.1.55. No known public exploitation has been reported at the time of publication.
