6 minhigh
Inductive Automation Ignition (CVE-2026-77393)
Inductive Automation Ignition versions 8.1.53 and earlier ship with a blank default value for the Gateway 'Create Project Role(s)' setting. This configuration error allows any authenticated user with the ability to execute gateway scripts to create projects. The vulnerability is classified as CWE-276 (Incorrect Default Permissions) with a CVSS v3.1 score of 8.8. The vendor fixed the issue in version 8.1.54 by restricting project creation to Designer sessions and removing reliance on the setting.
Sens:7dConf:high
IOCs1
1cve
Detection / Hunteropenrouter
What Happened
A configuration flaw in Inductive Automation Ignition software (versions 8.1.53 and older) means that any logged-in user who can run gateway scripts can also create new projects. This happens because a security setting that should restrict project creation to specific authorized roles was left blank by default. The software is used in critical infrastructure like manufacturing and energy. Organizations should upgrade to version 8.1.54 or later, or manually set the 'Create Project Role(s)' field to limit who can create projects. No attacks exploiting this flaw have been reported yet.
Key Takeaways
- CVE-2026-77393 affects Inductive Automation Ignition versions 8.1.53 and earlier due to a blank default value for the Gateway 'Create Project Role(s)' setting.
- Any authenticated user who can execute gateway scripts can create projects because no role is required by default.
- CVSS v3.1 base score is 8.8 (HIGH) with network attack vector and low privileges required.
- Remediation is to upgrade to 8.1.54 or later, or manually populate the 'Create Project Role(s)' setting to restrict project creation to authorized roles.
- No known public exploitation targeting this vulnerability has been reported to CISA.
Affected Systems
- Inductive Automation Ignition <=8.1.53
- Critical Manufacturing sector deployments
- Energy sector deployments
- Information Technology sector deployments
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-77393 | Inductive Automation Ignition | High | The Gateway 'Create Project Role(s)' setting shipped blank, permitting any authenticated user who can execute gateway scripts to create projects without requiring a specific role. |
Attack Chain
- Initial Access: Attacker authenticates to the Ignition Gateway with valid credentials.
- Privilege Misuse: Attacker executes gateway scripts, which is permitted under their authenticated session.
- Unauthorized Action: Due to the blank 'Create Project Role(s)' setting, the attacker creates projects without holding a designated project-creation role.
- Persistence: Created projects could be used to establish persistence or execute further malicious logic within the Ignition environment.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the advisory. The article is a vendor/CISA ICS advisory focused on remediation rather than detection logic.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The vulnerability is an application-level configuration issue within Ignition's web interface. EDR agents on the host would not have visibility into which Ignition user created a project or whether the 'Create Project Role(s)' setting is blank. |
| Network Visibility | Low | Project creation occurs over authenticated web sessions to the Ignition Gateway. Network monitoring would see legitimate HTTP/HTTPS traffic but would not distinguish unauthorized project creation from normal administrative activity. |
| Detection Difficulty | Moderate | Detection requires correlating Ignition Gateway audit logs with user role assignments to identify project creation by users lacking the Designer role. The challenge is that project creation is a legitimate function, so the signal is contextual rather than overtly malicious. |
Required Log Sources
- Ignition Gateway audit logs
- Ignition Gateway security event logs
- Application authentication logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for project creation events in Ignition Gateway audit logs performed by users who do not hold the Designer role or any role assigned to the 'Create Project Role(s)' setting. | Ignition Gateway audit logs and security event logs recording project creation actions and associated user identities. | Execution | Medium — legitimate administrators may create projects outside of Designer sessions in environments where the setting has been intentionally left permissive. |
| Consider reviewing the current value of the 'Create Project Role(s)' setting in Ignition Gateway general security settings to determine whether it is blank on any deployed instances. | Ignition Gateway configuration export or administrative interface inspection. | Configuration | Low — a blank setting is directly indicative of the vulnerable default configuration. |
Control Gaps
- Network-based IDS/IPS would not detect unauthorized project creation because the action occurs within an authenticated web session.
- EDR agents lack visibility into Ignition application-level role enforcement and project creation events.
- Standard SIEM rules without Ignition Gateway log ingestion would have no visibility into this activity.
Key Behavioral Indicators
- Project creation events in Ignition Gateway audit logs associated with non-Designer user sessions.
- Blank 'Create Project Role(s)' setting in Gateway general security configuration.
- Gateway script execution by users not assigned to administrative roles.
False Positive Assessment
Low — the vulnerability is a specific configuration defect with a clear remediation path. Detection of exploitation would rely on identifying project creation by unauthorized users, which is a narrow and contextual signal.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider upgrading all Inductive Automation Ignition instances running version 8.1.53 or earlier to version 8.1.54 or later.
- If upgrading is not immediately feasible, consider manually populating the 'Create Project Role(s)' setting in Gateway General Security Settings to match your organization's Designer Role.
- Consider auditing all deployed Ignition instances to identify those still running vulnerable versions or with a blank 'Create Project Role(s)' setting.
Infrastructure Hardening
- Evaluate whether Ignition Gateway interfaces are exposed to networks broader than necessary; consider restricting access to authorized administrative subnets.
- If applicable, consider isolating control system networks from business networks using firewalls as recommended by CISA ICS guidance.
- Where remote access to Ignition is required, consider using VPN with up-to-date versions rather than direct internet exposure.
User Protection
- Consider reviewing user accounts with gateway script execution privileges and limiting access to only those who require it.
- If your Ignition deployment supports role-based access control, consider verifying that project creation is restricted to the Designer role.
Security Awareness
- Consider incorporating ICS-specific vulnerability management into existing awareness programs, emphasizing the importance of reviewing default security configurations on deployment.
- If applicable, consider training operational technology staff on the significance of role-based access settings in Ignition and similar ICS platforms.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Privilege Escalation
Showing defanged values
- cveCVE-2026-77393The Gateway 'Create Project Role(s)' setting shipped blank, permitting any authenticated user who can execute gateway scripts to create projects without requiring a specific role.