Inductive Automation Ignition: Privilege escalation in Perspective module
Summary
The Perspective module of Ignition does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project can use their own valid Vision session identifier to gain Designer-level privileges. An attacker with these privileges could then execute arbitrary code in the context of the Ignition Gateway process.
Affected
- Ignition 8.1.0 through 8.1.54
- Ignition 8.3.0 through 8.3.8
- Other branches: Unknown.
Fixed in
- Ignition 8.1.55
- Ignition 8.3.9
- Update to the newest version available is recommended by the vendor.
Workaround
Unknown. No workaround is documented by the vendor or CISA; updating is the recommended remedy.
Exploitation
- No known public exploitation has been reported to CISA at this time.
- CISA SSVC assessment: exploitation none, not automatable, technical impact total.
- No public proof-of-concept was found in the sources reviewed.
Our recommendation
- Update Ignition to 8.1.55, 8.3.9 or newer in the next maintenance window, prioritizing internet-facing or multi-user Gateways.
- Until patched, limit Vision project access and Designer roles, restrict Gateway and Designer access to the management network, and review accounts for unnecessary privileges.
- Monitor Gateway logs for unexpected Designer sessions or unusual process activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Advisory ICSA-26-286-01 www.cisa.gov
- Inductive Automation Trust Center security.inductiveautomation.com
- CISA CSAF advisory JSON (ICSA-26-286-01) github.com
- Vulners CVE record CVE-2026-92817 vulners.com
- TheHackerWire CVE-2026-92817 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:13.
Original description (NVD)
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.