CISA published ICS advisory ICSA-26-286-01 on 13 October 2026 for Inductive Automation Ignition, a platform used in energy, manufacturing and IT. It covers CVE-2026-92817, rated 8.8 under CVSS v3.1 and 8.7 under v4.0. CISA says no known public exploitation specifically targeting it had been reported.
What's affected
- Ignition 8.1.0 through 8.1.54
- Ignition 8.3.0 through 8.3.8
- Fixed in 8.1.55 and 8.3.9
The advisory lists odd release dates for the fixed versions (8.3.9 as August 2025 and 8.1.55 as September 2026), and the revision history gives an initial publication of 2026-09-13. These look like typos, so check release dates in the vendor's Trust Center before you plan around them.
The flaw
The Perspective module does not properly validate session privileges when granting Designer level access. Per CISA, an authenticated user with access to a Vision project can use a valid Vision session identifier to gain Designer level privileges. That could allow arbitrary code execution in the Ignition Gateway process. The weakness is CWE-863, incorrect authorization.
The attacker needs a login. That lowers the risk compared with an unauthenticated bug, but plant networks often have many low privilege accounts.
What is confirmed, reported and unknown
- Confirmed by CISA: affected versions, the description, the scores and the exploitation statement.
- Reported by others: not used. This post relies on CISA only.
- Unknown: the real world number of exposed Gateways, and whether anyone is exploiting this beyond what has been reported.
How to check if you're exposed
- Open the Gateway status page and read the version.
- Compare it to the affected ranges above.
- List which accounts can open Vision sessions and which projects they can reach.
What to do now
- Upgrade to 8.1.55 or 8.3.9, or newer. CISA's guidance is to update to the newest available version.
- Until then, remove Vision project access from accounts that do not need it.
- Keep the Gateway off the internet. Reach it over a VPN.
- Review Designer launches and Gateway process activity for anything you cannot explain.
- Apply least privilege to every account that holds a Vision session.
How this could have been avoided
- Server side checks on every privilege grant. The module granted Designer rights without validating the session's privileges. Authorization has to be checked where the grant happens.
- Separation of session types. A Vision session identifier should not work as a credential in Perspective.
- Least privilege accounts. Fewer people with Vision access means fewer ways to use the flaw.
- Fast patching windows for OT software. Plan upgrades before an advisory lands.
Try it yourself
Check one Gateway: write down every account that can open a Vision session and the reason each one needs it.
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
Yes. The attacker is authenticated and has access to a Vision project, then uses a Vision session identifier to gain Designer rights.
Which versions fix it?
8.1.55 and 8.3.9.
