01 Record

CVE-2026-77393

Inductive Automation Ignition Incorrect Default Permissions

HighPUBLISHEDCNA: icscert

CNA base score8.7 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View raw JSON

02 Description

Inductive Automation Ignition Incorrect Default Permissions

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.50% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 42.9% of scored records. A rank, not a probability.

NVD base score

8.7 (CVSS v4.0), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD analysis status

Awaiting Analysis. NVD last modified this record on 2026-09-08.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-04 21:10Z1 MO AGO

Last updated

2026-09-07 11:17Z1 MO AGO

Reserved

2026-08-20

Assigning CNA

icscert

Record state

PUBLISHED

Severity

High (CVSS 8.7)

CNA CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weaknesses

CWE-276Incorrect Default PermissionsBase

Data version

5.2

Document digest

ac77a57dafff72f4966c68a75f6b9f805eb06f452bd49e620c1e81e053096c8a

05 Affected products

VendorProductVersionsPlatforms

Inductive AutomationIgnition0 to 8.1.53—

06 References

security.inductiveautomation.comhttps://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3
www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-246-06
github.comhttps://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-06.json

07 Remediation

Inductive Automation has determined that this issue is a default-value configuration, not a flaw in the access control itself. The security control enforces exactly what the "Create Project Role(s)" setting specifies; because the setting shipped blank, no role was required to create a project. Populating the setting fully closes the vulnerability. Inductive Automation recommends users upgrade to 8.1.54 or later (or the latest 8.3 version), which restricts project creation to Designer sessions and no longer relies on this setting. Users who must remain on an earlier 8.1 version can fully remediate the issue by setting "Create Project Role(s)" to match their Designer Role. Once the setting is populated, only users holding that role can create projects. See Gateway General Security Settings. https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3