1. Executive summary
CISA has published ICS advisory ICSA-26-246-06 covering CVE-2026-77393 in Inductive Automation Ignition 8.1.53 and earlier: the Gateway "Create Project Role(s)" setting shipped blank, so any authenticated user able to execute gateway scripts could create projects without holding any authorisation role. CISA scores this HIGH — CVSS v3.1 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) — classified as CWE-276 Incorrect Default Permissions. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. Ignition is deployed in industrial control and manufacturing environments worldwide; for EMEA financial services the exposure is indirect — building management, facility, and physical-infrastructure OT estates that sit adjacent to corporate networks — but a low-privilege foothold that can inject arbitrary gateway-script logic into a running SCADA platform is a genuine pivot risk.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The advisory describes a default-configuration weakness in an ICS product with no reported exploitation, no incident, and no identified financial-sector dependency; the generic fact that "a patch is available" does not itself trigger the reporting, testing, or third-party articles in the reference set. Clients running Ignition in an in-scope OT/facility estate should nonetheless log the upgrade under their existing ICT risk processes.
3. Technical analysis & attack chain
Vulnerability mechanism. Ignition's Gateway enforces project creation against the "Create Project Role(s)" setting in the Gateway General Security Settings. In the 8.1 series through 8.1.53, that setting shipped with no value. The access-control check itself functions correctly — it enforces exactly what the setting specifies — but because the setting was blank, the effective policy required no role at all. The result: any authenticated Gateway user could create a project, provided they can execute gateway scripts. The vendor characterises this as a default-value configuration issue rather than a flaw in the access-control logic; populating the setting fully closes the vulnerability.
Attack chain (confirmed from the advisory)
- Attacker authenticates to the Ignition Gateway with any valid account — the vulnerability requires privileges (PR:L), so this is not anonymous, but no specific role is needed.
- Attacker creates a new project. On an unpatched 8.1.x (≤8.1.53) Gateway with the blank default, no role check blocks this.
- Because the precondition is the ability to execute gateway scripts, project creation is a vehicle for running attacker-supplied logic in the Gateway context — the C:H/I:H/A:H impact metrics reflect full confidentiality, integrity and availability impact within the Gateway scope (S:U — no scope escape is claimed).
Affected and fixed versions
- Affected: Inductive Automation Ignition ≤8.1.53 (CVE-2026-77393),
known_affected. - Fixed: 8.1.54 and later — project creation is restricted to Designer sessions and no longer relies on the "Create Project Role(s)" setting.
- Not affected: the entire 8.3 series.
Context. CISA lists Critical Manufacturing, Energy and Information Technology as critical-infrastructure sectors, with worldwide deployment and US-headquartered vendor. The vulnerability was reported by Christopher Lusk of North Echo Security Research and independently by Elhussain Fathy (0xSphinx), who also confirmed the fix; Inductive Automation reported it to CISA. No threat actor is named and no exploitation has been reported — there is no attribution to assess. Note the advisory's own summary table lists "v3 8.8" while the metrics block gives both v3.1 8.8 and v4.0 8.7; both are HIGH and we treat them as stated.
4. Mitigation & containment
P1 — within 24h
- Inventory for Ignition Gateways at version ≤8.1.53. The Gateway web interface exposes the current version; check any instance reachable from corporate networks or exposed to remote access.
- If an affected Gateway is internet-exposed, remove the exposure immediately — CISA's standing guidance applies: control-system devices should not be accessible from the internet, and control networks should sit behind firewalls, isolated from business networks. Where remote access is required, use an up-to-date VPN, recognising a VPN is only as secure as the connected devices.
P2 — within 72h
- Upgrade affected Gateways to Ignition 8.1.54 or later, or to the latest 8.3 release. Both code paths remove reliance on the blank setting: 8.1.54+ restricts project creation to Designer sessions.
- If an earlier 8.1 version must remain in place, remediate by configuration: set "Create Project Role(s)" in the Gateway General Security Settings to match the Designer Role. Once populated, only users holding that role can create projects. Vendor documentation: https://docs.inductiveautomation.com/docs/8.1/platform/security/gateway-general-security-settings#gateway-security-settings-table
P3 — within 7 days
- Review Gateway user accounts and roles: enumerate authenticated users who could have created projects on affected Gateways since deployment, and audit the project list for unexpected projects.
- Verify the fix: on 8.1.54+ confirm project creation is Designer-session-only; on patched-config 8.1.x confirm a non-privileged authenticated user cannot create a project.
- Fold Ignition into OT asset-management and network-segmentation review so future Gateway defaults are caught at onboarding.
5. Indicators of compromise
No indicators of compromise available in the source material. No exploitation has been reported to CISA and the advisory contains no atomic indicators. The observable to hunt for is behavioural: unexpected project creation on Ignition Gateways by accounts that should not hold a Designer-equivalent role — audit the Gateway's project list and creation events against your role assignments.
6. Detection
Insufficient indicators to author detection rules. The advisory provides no strings, file artefacts, command lines, registry keys or log signatures; the vulnerability is a configuration default, and any rule built from the product name or CVE identifier would detect reporting about the threat, not the threat. Clients with Ignition Gateways should instead alert on project-creation events by non-Designer accounts, using the Gateway's own audit logging.
7. Sources
- CISA, "Inductive Automation Ignition" (ICS Advisory ICSA-26-246-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-06, 2026-09-03
- Inductive Automation Trust Center publication (referenced by CISA), https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3
- Inductive Automation documentation, "Gateway General Security Settings", https://docs.inductiveautomation.com/docs/8.1/platform/security/gateway-general-security-settings#gateway-security-settings-table
8. Adverse Trace position
HIGH severity as scored by CISA (CVSS v3.1 8.8 / v4.0 8.7), but with two material qualifiers: exploitation requires an authenticated foothold with gateway-script execution capability, and no exploitation has been reported to CISA. For EMEA financial services the direct attack surface is limited — Ignition belongs to the OT/facilities tier, not the transactional estate — but that is precisely why it gets missed: low-visibility building and plant systems are a proven pivot path, and a Gateway that lets any authenticated user create script-bearing projects is a clean persistence mechanism once initial credentials are obtained. The fix is trivially cheap (upgrade to 8.1.54+, or populate one setting), so there is no defensible reason to run the vulnerable default. Attribution is not in play and we make no claim about actor interest. We will monitor for any change in CISA's exploitation status and for a CISA KEV listing; clients should treat this as a scheduled patch-cycle item with an immediate configuration check on any internet-adjacent Gateway.
Published via PulseTrace — Adverse Trace threat intelligence.