Inductive Automation Ignition Software
Monitor6.3ICS-CERT ICSA-26-071-06Mar 12, 2026
Attack VectorAdjacent
Auth RequiredHigh
ComplexityHigh
User InteractionRequired
Summary
Inductive Automation Ignition Software versions before 8.3.0 contain a deserialization vulnerability (CWE-502) that allows an authenticated, privileged application user to execute malicious code with OS application service account permissions beyond what the user intended.
What this means
What could happen
An authenticated user with Designer or Config permissions could craft a malicious project or configuration that executes arbitrary commands on the host system running Ignition, potentially compromising the gateway, connected devices, and downstream process control systems.
Who's at risk
Water utilities, electric utilities, and manufacturers operating Inductive Automation Ignition gateways for SCADA, HMI, and process automation systems. Specifically affects organizations running Ignition 8.1.x or 8.2.x that have privileged users with Designer or configuration write permissions (such as engineering contractors, systems integrators, or internal automation staff).
How it could be exploited
An attacker with valid Ignition Designer credentials (or Config Page/Config Write permissions in 8.3.x) could import or create a project containing malicious serialized objects. When Ignition deserializes this project, the malicious code executes with the service account's permissions, bypassing the authenticated user's intended privilege level.
Prerequisites
- Valid Ignition Designer credentials (or Config Page/Config Write permissions in 8.3.x)
- Ability to import a project or modify gateway configuration
- Ignition version 8.1.x or 8.2.x (versions before 8.3.0)
Requires valid privileged credentials (insider threat or compromised account)Affects integrity and availability of control systemsModerate CVSS score (6.3) with high complexity and high privilege requirementsActively used in critical infrastructure
Exploitability
Low exploit probability (EPSS 0.0%)
Affected products (1)
ProductAffected VersionsFix Status
Ignition Software: <8.3.0<8.3.08.3.0
Remediation & Mitigation
0/8
Do now
0/3HARDENINGFor 8.1.x systems unable to patch immediately: restrict and enforce credential controls - enforce strong passwords and multi-factor authentication (MFA) for all users with Designer permissions, Config Page permissions (8.1.x), or Config Write permissions (8.3.x)
HARDENINGFor 8.1.x systems unable to patch immediately (Linux): implement Ignition Security Hardening Guide Appendix A to restrict the service account permissions
HARDENINGFor 8.1.x systems unable to patch immediately (Windows): create a dedicated service account with minimal privileges, remove from all group memberships (including Users and Administrators), deny write access to Windows and user directories, and restrict temp directory access
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpgrade Ignition Software from 8.1.x to version 8.3.0 or later
HARDENINGRestrict project imports to verified and trusted sources only; use checksums or digital signatures to validate projects before import
Long-term hardening
0/3HARDENINGImplement a multi-environment deployment workflow (Dev, Test, Prod) with staging and validation before any changes reach production
HARDENINGSegment or isolate Ignition gateways from corporate networks and Windows domains; use LDAP, SAML, or OpenID Connect for Active Directory federation if required instead of granting domain privileges to the Ignition service account
HARDENINGEnsure Ignition gateways are not directly exposed to the Internet; locate behind firewalls and isolate from business networks
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/b555ef30-5d07-4166-a72b-578a60384f0f