CISA 2026-09-03

Inductive Automation Ignition

CVE-2026-77393

Machine-generated analysis · WAYSCloud LLM

Versions 8.1.53 and earlier of Inductive Automation Ignition allow any authenticated user to create projects because the default "Create Project Role(s)" setting is blank. The issue is resolved in version 8.1.54 and later.

Context

The advisory concerns Inductive Automation Ignition. In versions 8.1.53 and earlier the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects. Ignition 8.1.54 and the 8.3 series restrict project creation to Designer sessions and are not affected.

Operator considerations

Check: Verify the installed Ignition version and whether the "Create Project Role(s)" setting is populated.
Patch: Upgrade to Ignition 8.1.54 or later (or the latest 8.3 version), or configure the setting to match the Designer role for earlier versions.
Log: Monitor project creation events and gateway script execution for unexpected activity.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow any authenticated user to create projects.

The following versions of Inductive Automation Ignition are affected:

Ignition

Read the full advisory on CISA →