Vulnerabilities
Inductive Automation Ignition Privilege Escalation Vulnerability (CVE‑2026‑92817)
Inductive Automation’s Ignition platform (8.1.0‑8.1.54 and 8.3.0‑8.3.8) suffers a privilege‑escalation flaw that lets an authenticated Vision user gain Designer rights and execute arbitrary code. The CVSS v3 score is 8.8. Immediate patching to 8.1.55 or 8.3.9 is required.
What Happened
Inductive Automation’s Ignition platform (versions 8.1.0‑8.1.54 and 8.3.0‑8.3.8) contains a flaw in the Perspective module that fails to validate session privileges when determining Designer‑level access. An authenticated user who can access a Vision project can supply a valid Vision session ID and obtain Designer privileges, allowing them to run arbitrary code as the Ignition Gateway process.
Impact
The vulnerability (CVE‑2026‑92817) carries a CVSS v3 score of 8.8 and can be leveraged by low‑privilege users to gain full control over the Ignition Gateway, potentially affecting critical manufacturing, energy, and IT infrastructure worldwide.
Mitigation
Inductive Automation released patched versions: 8.1.55 (Sept 2026) and 8.3.9 (Aug 2025). All affected installations should be upgraded to the latest release immediately. If an upgrade is not possible, disable the Perspective module or restrict Vision project access until a patch is applied.
What to Do
- Verify your Ignition version and confirm if you are within the affected range.
- Apply the latest patch (8.1.55 or 8.3.9) as soon as possible.
- Audit user permissions to ensure Vision project access is limited to trusted accounts.
- Monitor for suspicious activity such as unexpected Designer‑level operations.
Related vulnerabilities
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
Windows License Manager Privilege Escalation Vulnerability (CVE‑2026‑62777)
Microsoft has disclosed a local privilege‑escalation flaw in the Windows License Manager component. The vulnerability could allow an attacker with local access to gain SYSTEM rights. Defenders should monitor for suspicious activity and apply the forthcoming update when available.
Read briefing
CVE-2026-83826: Windows Error Reporting Privilege Escalation Vulnerability
A local privilege escalation flaw in Windows Error Reporting allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. The issue affects all Windows 10/11 installations that have Error Reporting enabled. Apply the latest security update or disable the service to mitigate.
Read briefing
CVE-2026-69840: Windows Certificates Use‑After‑Free Privilege Escalation Vulnerability
A use‑after‑free flaw in Windows Certificates can be exploited by an authenticated local user to gain elevated privileges. The issue affects all current Windows 10/11 and Windows Server releases until the latest cumulative update. Defenders should apply the patch immediately, enforce least‑privilege, and monitor certificate processing for anomalous activity.
Read briefing