As reported by CISA in advisory ICSA-26-246-06, Inductive Automation Ignition versions 8.1.53 and earlier ship with a blank "Create Project Role(s)" Gateway setting, allowing any authenticated user to create projects — provided they can execute gateway scripts. The flaw, tracked as CVE-2026-77393, carries a CVSS v3.1 base score of 8.8 (HIGH) and falls under CWE-276 (Incorrect Default Permissions).
Vulnerability Details
| CVE | CVE-2026-77393 |
|---|---|
| CVSS | 8.8 HIGH (CVSS:3.1/AV:N/AC:L) |
| Affected | Ignition <= 8.1.53 |
| Not Affected | Ignition 8.1.54+, all 8.3.x versions |
| Vendor | Inductive Automation (United States) |
| CWE | CWE-276 — Incorrect Default Permissions |
| Patch Available | Yes — upgrade to 8.1.54 or latest 8.3 |
| Workaround | Set "Create Project Role(s)" to match Designer Role |
| Active Exploitation | Not confirmed in the advisory |
Why This Matters More Than the CVSS Suggests
On paper, an 8.8 is serious. In context, the risk profile is arguably higher for operational technology environments. Ignition is a widely deployed SCADA/HMI platform spanning Critical Manufacturing, Energy, and IT sectors globally. The vulnerability doesn't require a crafted payload or memory corruption — it's a configuration default that quietly grants project creation rights to every authenticated user. That means a low-privilege operator account, a service account, or a compromised credential can spawn new projects containing gateway scripts.
Ignition projects aren't passive artifacts. They can include Perspective views, scripting modules, and logic that interacts with PLCs, databases, and downstream industrial devices. An attacker who can create a project gains a foothold to inject scripts that may execute within the Gateway's trust boundary — potentially bridging a foothold into process manipulation, data exfiltration, or lateral movement across the OT fabric.
The most dangerous vulnerabilities in ICS aren't always zero-days. They're the ones where the product works exactly as configured — and the configuration was wrong from the factory.
Who Is Most Exposed
- Manufacturing and energy facilities running Ignition 8.1.x without reviewing Gateway security settings on deployment.
- Environments with broad authenticated user bases — shared operator accounts, contractor access, or integrator credentials retained post-commissioning.
- Internet-exposed Ignition Gateways, where the attacker only needs valid credentials rather than network adjacency.
- Systems where gateway script execution is broadly permitted, which is the prerequisite condition for exploitation.
The Secure-by-Default Problem in OT
Inductive Automation correctly notes this is a default-value issue, not an access control bypass. That distinction matters legally but matters less operationally. The broader pattern — OT software shipping with permissive defaults that assume the integrator will harden the system — remains one of the most persistent sources of real-world ICS risk. Integrators under project deadlines rarely audit every Gateway setting, and the blank field blended into a large configuration surface.
Version 8.1.54's architectural shift — restricting project creation to Designer sessions rather than relying on a role setting — is the right move. It removes the configuration footgun entirely. Organizations that can upgrade should prefer this path over the workaround, which depends on administrators correctly identifying and populating the role field without missing other permissive defaults.
