CVE-2026-77393

Received Received - Intake

Authentication Bypass in Ignition Gateway

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: ICS-CERT

Description

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-77393

Affected Vendors & Products

Vendor	Product	Version / Range
inductive_automation	ignition	8.1.53
inductive_automation	ignition	8.1.54

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

Executive Summary

In Ignition 8.1.53 and earlier, a blank Gateway setting allowed any authenticated user to create projects by executing gateway scripts. Ignition 8.1.54 fixed this by restricting project creation to Designer sessions only.

Detection Guidance

This vulnerability can be detected by checking the Ignition Gateway version. If the version is 8.1.53 or earlier, the system is vulnerable. Upgrade to version 8.1.54 or later to mitigate the risk.

Impact Analysis

An attacker with authenticated access could create unauthorized projects, potentially leading to system misuse, data exposure, or further exploitation of the Ignition environment.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized project creation, potentially leading to data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Ignition to version 8.1.54 or later to restrict project creation to Designer sessions and remove reliance on the blank Gateway setting.

Hi! I’m here to help you understand CVE-2026-77393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70