Session Privilege Escalation in Ignition Perspective Module by Inductive Automation
CVE-2026-92817

8.7HIGH

Key Information:

Vendor

Inductive Automation

Status
Ignition
Vendor
CVE Published:
13 October 2026

What is CVE-2026-92817?

The Ignition Perspective module from Inductive Automation contains a vulnerability where session privileges are not adequately validated. An authenticated user with Vision project access may exploit this flaw by supplying a valid Vision session identifier, thereby acquiring Designer-level privileges. This unauthorized elevation of access can lead to potential arbitrary code execution within the Ignition Gateway process, posing significant risks to system integrity and security.

Affected Version(s)

Ignition 8.1.0 <= 8.1.54

Ignition 8.3.0 <= 8.3.8

Ignition 8.1.55

References

https://security.inductiveautomation.com/?tcuUid=34477620...
https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Hemingway reported this vulnerability to Inductive Automation.
.