CVE-2026-77393

HighCVSS 8.8

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 05/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

Risk Assessment

Authenticated users without proper permissions can create projects, potentially leading to unauthorized system changes, compromising integrity and access control. This could be exploited for privilege escalation or unauthorized actions.

Recommendation

Upgrade Ignition to version 8.1.54 or later to restrict project creation to Designer sessions.

Other vulnerabilities in Ignition

CVE-2025-13911Medium
Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS