Ignition Perspective EUVD-2026-100758

Exploitation requires an attacker who is already an authenticated user with legitimate access to a Vision project on the target Ignition Gateway and who possesses a valid Vision session identifier (PR:L); the attacker supplies that Vision session ID to the Perspective module, which fails to validate session privileges when determining Designer-level access, granting elevated Designer rights that enable code execution in the Gateway process. Limiting factors: valid low-privilege Vision credentials/session are mandatory (not unauthenticated), both the Vision and Perspective modules must be in use on the Gateway, and network reachability to the Gateway is needed; no user interaction is required (UI:N) and attack complexity is low (AC:L).

This is a genuine high-priority issue in an OT/ICS context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) describes a network-reachable, low-complexity authorization flaw (CWE-863) that a low-privileged but authenticated user can abuse to escalate to Designer-level access and achieve arbitrary code execution in the Ignition Gateway process - full confidentiality, integrity, and availability impact. The key mitigating signal is PR:L: the attacker must already be an authenticated user with legitimate access to a Vision project, so this is privilege escalation rather than unauthenticated pre-auth RCE. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization at this time - the urgency derives from the severity and the high value of Gateway RCE in industrial environments, not from observed in-the-wild activity. One point to verify: the Tags label this an 'Authentication Bypass,' but the description and CWE-863 indicate an authorization/privilege-validation failure affecting an already-authenticated user, not an authentication bypass - treat it as privilege escalation when prioritizing.

A user who legitimately holds a Vision-project account on an Ignition Gateway logs in, captures their own valid Vision session identifier, and presents it to the Perspective module, which fails to validate that the session is entitled to Designer-level access. Having been granted Designer privileges, the attacker uses them to execute arbitrary code within the Ignition Gateway process, compromising the SCADA server. No public exploit code is identified at time of analysis, and the attack is network-based with low complexity but requires valid low-level Vision credentials (PR:L).