CVE-2026-92817: Ignition Perspective Auth Bypass Vulnerability

CVE-2026-92817 Overview

CVE-2026-92817 is an authorization flaw in the Inductive Automation Ignition Perspective module. The module fails to properly validate session privileges when determining Designer-level access. An authenticated user holding a valid Vision project session can submit that session identifier to the Perspective module and obtain Designer-level privileges. Designer access permits execution of arbitrary code within the Ignition Gateway process, which typically runs with elevated service rights on industrial control system (ICS) hosts. The weakness is tracked as CWE-863: Incorrect Authorization and is documented in CISA ICS Advisory ICSA-26-286-01.

Critical Impact
Any authenticated Vision project user can escalate to Designer and execute arbitrary code in the Ignition Gateway process, compromising the operational technology (OT) host.

Affected Products

Inductive Automation Ignition — Perspective module (see vendor advisory for fixed versions)
Deployments where Vision and Perspective modules are both enabled on the same Gateway
ICS/OT environments exposing Ignition Gateway to authenticated users

Discovery Timeline

2026-10-14 - CVE-2026-92817 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-92817

Vulnerability Analysis

Ignition is an industrial application platform used to build human-machine interfaces (HMIs), supervisory control and data acquisition (SCADA) screens, and gateway services. The platform exposes two client surfaces: the legacy Vision module and the newer Perspective module. Each module issues its own session identifiers and enforces its own privilege boundaries.

The Perspective module trusts a Vision-issued session identifier when deciding whether the caller holds Designer privileges. Designer is an authoring role that can modify project resources and run Jython scripts inside the Gateway Java Virtual Machine (JVM). An attacker who already holds low-privilege Vision access can therefore pivot to code execution on the Gateway host.

Successful exploitation yields arbitrary code execution in the context of the Ignition Gateway process, which commonly interfaces with programmable logic controllers (PLCs) and other OT equipment.

Root Cause

The root cause is incorrect authorization [CWE-863]. The Perspective module performs an authentication check on the supplied session identifier but does not verify that the session was issued by Perspective itself or that the session carries Designer-level entitlements. Session scope and role are conflated, so a valid Vision session satisfies the Designer gate.

Attack Vector

The attack is network-reachable and requires only low privileges. An authenticated Vision user captures or generates a Vision session identifier, replays it to a Perspective endpoint that gates Designer actions, and invokes a Designer-only operation such as script execution. Because Designer sessions can run Jython against the Gateway JVM, the attacker achieves arbitrary code execution with the Gateway service account.

No verified public exploit code is available at the time of writing. Refer to the Inductive Automation Security Advisory for authoritative technical details.

Detection Methods for CVE-2026-92817

Indicators of Compromise

Perspective Gateway audit entries showing Designer-scoped actions initiated by accounts that were only provisioned for Vision project access.
Unexpected Jython script execution, project resource modification, or module reload events in wrapper.log and the Gateway audit log.
Outbound connections from the Ignition Gateway process to unknown hosts shortly after a session reuse event.

Detection Strategies

Correlate session identifiers issued by the Vision authentication path with subsequent Perspective API calls that require Designer privileges.
Alert on any Designer-level action from a user whose assigned roles exclude Designer in the identity provider or Ignition role mapping.
Baseline normal Designer activity by user, source IP, and time of day, and flag deviations.

Monitoring Recommendations

Forward Ignition Gateway audit logs, wrapper.log, and web server access logs to a central SIEM or data lake for correlation.
Monitor Gateway host process creation and child processes of the Ignition JVM for signs of post-exploitation activity.
Track administrative API calls that create, modify, or export project resources, and require ticketed change control for each.

How to Mitigate CVE-2026-92817

Immediate Actions Required

Upgrade Ignition to the fixed Perspective module version listed in the Inductive Automation advisory.
Restrict network access to the Ignition Gateway so that only authorized operator and engineering workstations can reach Vision and Perspective endpoints.
Audit all accounts holding Vision access and remove those no longer required; rotate credentials and invalidate active sessions after patching.
Review Gateway audit logs for Designer actions performed since the module was deployed.

Patch Information

Inductive Automation has published fixed versions and remediation guidance in the Inductive Automation Security Advisory. Coordinated disclosure details are available in the CISA ICS Advisory ICSA-26-286-01 and the corresponding GitHub CSAF Document. Apply the vendor-supplied update to every Gateway instance before re-exposing Perspective to users.

Workarounds

If immediate patching is not possible, disable the Vision module on Gateways that primarily serve Perspective projects to prevent issuance of Vision sessions.
Place the Ignition Gateway behind a reverse proxy or VPN that enforces strong authentication and limits client reachability to the Perspective endpoints.
Enforce least privilege in Ignition role mappings so that general operators cannot authenticate to Vision projects at all.

bash

# Example: restrict Ignition Gateway to a management VLAN with iptables
iptables -A INPUT -p tcp --dport 8043 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8043 -j DROP
iptables -A INPUT -p tcp --dport 8088 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8088 -j DROP