CVE-2026-77393 Inductive Automation CVE debrief

Who should care

Defenders and administrators of Ignition deployments, especially those in industrial control systems (ICS) environments, should assess exposure and verify remediation. They should review the vulnerability details, verify the Ignition version, and restrict project creation to Designer sessions. Additionally, they should monitor for authenticated users executing gateway scripts and review compensating controls for exposed systems.

Why it matters

CVE-2026-77393 allows authenticated users to create projects in Ignition 8.1.53 and earlier if they can execute gateway scripts. Defenders should verify and remediate this vulnerability, especially in ICS environments.

• Authenticated users can create projects if they can execute gateway scripts
• Project creation is restricted to Designer sessions in Ignition 8.1.54

Technical summary

The Gateway 'Create Project Role(s)' setting in Ignition 8.1.53 and earlier shipped blank, permitting any authenticated user to create projects if they can execute gateway scripts. This issue was fixed in Ignition 8.1.54, which restricts project creation to Designer sessions. The vulnerability allows authenticated users to create projects, potentially leading to unauthorized access or modifications in Ignition deployments, especially in ICS environments. Defenders should assess exposure and verify remediation to prevent potential security breaches.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Ignition deployments, especially in systems where authenticated users can execute gateway scripts.

Recommended defensive actions

• Verify Ignition version and check if vulnerable
• Restrict project creation to Designer sessions
• Monitor for authenticated users executing gateway scripts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in Ignition 8.1.53 and earlier. The issue was fixed in Ignition 8.1.54. Defenders should verify and remediate this vulnerability, especially in ICS environments, with explicit evidence limits and defensive verification tasks. Evidence limits suggest a detailed review of Ignition deployments, especially in industrial control systems (ICS) environments, is necessary to assess exposure and verify remediation. The CVE details indicate that authenticated users can create

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.