Inductive Automation Ignition vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Inductive Automation Ignition: 3 record(s), with affected versions and fixes.
cpe:2.3:a:inductiveautomation:ignition

CVE-2026-92817 High · 8.8 CWE-863 Oct 13, 2026

Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

CVE-2025-13913 Medium · 6.8 CWE-502 Mar 12, 2026

Inductive Automation Ignition Software Deserialization of Untrusted Data

A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.

CVE-2025-13911 Medium · 6.4 CWE-250 Dec 18, 2025

Inductive Automation Ignition Execution with Unnecessary Privileges

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system. This affects both Windows and Linux installations. On Windows, default installations often run the Ignition service as NT AUTHORITY\SYSTEM, resulting in code execution with full local system privileges. On Linux, default installations commonly run the Ignition service as root or with elevated privileges. Specific privilege level depends on installation configuration.