CVE-2026-92817
Received Received - Intake

Ignition Perspective Session Privilege Escalation

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: ICS-CERT

Description
The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-92817
EUVD
EUVD-2026-100758

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Inductive Automation Ignition 8.1.0
Inductive Automation Ignition 8.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Ignition Perspective module due to improper validation of session privileges for Designer-level access. An authenticated user with Vision project access can exploit a valid Vision session ID to gain elevated Designer privileges. This allows them to execute arbitrary code within the Ignition Gateway process.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to the Ignition Perspective Designer module. Monitor logs for unusual session activity or privilege escalation events. Review network traffic for requests to the Designer endpoint with Vision session tokens. Ensure session validation is enforced in the Ignition Gateway configuration.

Impact Analysis

An attacker could exploit this to gain unauthorized access to system design tools, modify configurations, or execute malicious code on the Ignition Gateway. This could lead to data breaches, system compromise, or disruption of industrial control processes if the gateway manages critical systems.

Compliance Impact

This vulnerability could lead to unauthorized access and data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using Ignition may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update Ignition to the latest patched version. Restrict Vision project access to only trusted users. Monitor Gateway logs for unauthorized Designer-level access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92817. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart