CVE-2026-92817: CWE-863 in Inductive Automation Ignition

The Ignition Perspective module in Inductive Automation Ignition does not properly validate session privileges when determining Designer-level access. An authenticated user who has access to a Vision project can exploit this by providing their valid Vision session identifier to gain elevated Designer-level privileges. This escalation of privileges allows the attacker to execute arbitrary code in the context of the Ignition Gateway process. The vulnerability is identified as CWE-863 (Incorrect Authorization). It affects versions >=8.1.0 <=8.1.54 and >=8.3.0 <=8.3.8. There are no known exploits in the wild and no vendor patch links provided in the data.

Successful exploitation allows an authenticated user with limited privileges to escalate to Designer-level access, which can lead to arbitrary code execution within the Ignition Gateway process. This can compromise the integrity, confidentiality, and availability of the affected system. The CVSS 3.1 base score of 8.8 reflects high impact on confidentiality, integrity, and availability with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and consider limiting Vision project access to trusted personnel only to reduce risk.