Inductive Automation Ignition Software
Plan PatchCVSS 8.8ICS-CERT ICSA-26-286-01Oct 13, 2026
Inductive Automation
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level.
What this means
What could happen
Could allow full system compromise — read data, modify settings, and disrupt operations
Who's at risk
Organizations in critical infrastructure using Inductive Automation equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device with basic access credentials. The attack is straightforward with no special conditions
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (2)
2 pending
ProductAffected VersionsFix Status
Ignition: >=8.1.0|<=8.1.54≥ 8.1.0|≤ 8.1.54No fix yet
Ignition: >=8.3.0|<=8.3.8≥ 8.3.0|≤ 8.3.8No fix yet
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
UPGRADEInductive Automation released version 8.3.9 in August 2025 and version 8.1.55 in September 2026 to address this issue. Users are recommended to update to the newest version available.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/1d6a70ae-202a-4e85-a3a2-dcde6f051ed0Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.