CISA republishes Ignition advisory on blank role setting that can let users create projects

By Atlas Watchline Staff · Regulatory · September 3, 2026

CISA republished an advisory on Sept. 3, 2026, warning that a blank default setting in Inductive Automation’s Ignition could let any authenticated user create projects in affected versions.

CISA republished an advisory on Sept. 3, 2026, warning that a blank default setting in Inductive Automation’s Ignition could let any authenticated user create projects in affected versions.

CISA said the issue affects Inductive Automation Ignition 8.1.53 and earlier and is tracked as CVE-2026-77393. The agency said successful exploitation could allow any authenticated user to create projects if they can execute gateway scripts.

CISA rates the issue high severity, with a CVSS v3.1 base score of 8.8 and a CVSS v4.0 base score of 8.7.

The problem is tied to the Gateway “Create Project Role(s)” setting, which shipped blank in affected versions. CISA said the 8.3 series is not affected.

According to the advisory, Ignition 8.1.54 changes project creation so it is restricted to Designer sessions and no longer relies on the blank setting. CISA said Inductive Automation treated the issue as a default-value configuration problem rather than a flaw in the access-control design itself.

The advisory maps the issue to CWE-276, or Incorrect Default Permissions. CISA said the CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It also listed the CVSS v4.0 vector as CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

CISA said the recommended fix is to upgrade to 8.1.54 or later, or the latest 8.3 version. For organizations staying on earlier 8.1 releases, the agency said users should set “Create Project Role(s)” to match the Designer Role so only users with that role can create projects.

The advisory credited Christopher Lusk of North Echo Security Research and Elhussain Fathy, known as 0xSphinx, for reporting the vulnerability. CISA said no known public exploitation specifically targeting this issue had been reported at the time of publication.

Operators of affected Ignition installations will need to apply the update or change the role setting. CISA’s advisory was initially released on Sept. 3, 2026.

Sources

• CISA Cybersecurity Advisory: ICSA-26-246-06

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.