EUVD-2026-71775
GHSA-c95r-xfc2-mhwg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network access with low privilege required; both script execution and auth needed; high ICS operational impact justifies C/I/A:H.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
5DescriptionCVE.org
In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.
AnalysisAI
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be met: (1) the attacker must hold a valid authenticated session to the Ignition Gateway (PR:L - any credential-holder, not necessarily a privileged role); and (2) that session must have permission to execute gateway scripts, which is a separate, non-default capability grant within Ignition's RBAC model. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with VC:H/VI:H/VA:H reflects the potential operational impact in ICS deployments rather than a straightforward web-app privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Ignition 8.1.54. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Ignition deployments in your organization and determine which systems run version 8.1.53 or earlier; prioritize production SCADA/HMI environments and safety-critical facilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Rated critical severity (C
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0,
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Rated high severity (CVSS
Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML securit
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ig
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can l
The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. Rated critical sever
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline
The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code. Rated hi
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today