CVE-2026-77393

HIGH 8.8

Inductive Automation Ignition Incorrect Default Permissions

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

CWE	CWE-276
Vendor	inductive automation
Product	ignition
Published	Sep 4, 2026
Last Updated	Sep 7, 2026

Stay Ahead of the Next One

Get instant alerts for inductive automation ignition

Be the first to know when new high vulnerabilities affecting inductive automation ignition are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Inductive Automation / Ignition

0 ≤ 8.1.53

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.inductiveautomation.com: https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3 cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-06 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-06.json

Credits

Christopher Lusk of North Echo Security Research reported this vulnerability to Inductive Automation. Elhussain Fathy (0xSphinx) independently reported this vulnerability and confirmed the fix.