Ignition SCADA EUVD-2026-71775

Two concrete prerequisites must both be met: (1) the attacker must hold a valid authenticated session to the Ignition Gateway (PR:L - any credential-holder, not necessarily a privileged role); and (2) that session must have permission to execute gateway scripts, which is a separate, non-default capability grant within Ignition's RBAC model. Exploitation is bounded by the requirement for this dual authorization. Environments that do not grant script execution rights to general user accounts significantly reduce exposure. The 8.3 series is architecturally exempt. The 'Create Project Role(s)' gateway setting being blank is the necessary vulnerable condition; sites that had proactively populated that setting were not exposed even on vulnerable versions.

The CVSS 4.0 score of 8.7 with VC:H/VI:H/VA:H reflects the potential operational impact in ICS deployments rather than a straightforward web-app privilege escalation. The PR:L metric is accurate: exploitation requires a valid authenticated session AND the ability to execute gateway scripts - a subset of authenticated users, not all of them. This somewhat narrows real-world exploitability compared to a fully unauthenticated vector. EPSS data is not provided; the ICS-CERT reporting origin and SCADA context suggest the concern is targeted industrial espionage or sabotage rather than opportunistic mass exploitation. No public exploit or KEV listing exists, which is consistent with the specialized knowledge required to weaponize project creation in an ICS context. The high C/I/A impact ratings are plausible because a malicious project could deploy altered PLC tag bindings, screen logic, or scripted actions affecting physical process control - but only if the attacker already has script execution rights, limiting the practical blast radius.

An authenticated Ignition user with gateway script execution rights - for example, a lower-privileged operator account that legitimately runs diagnostic scripts - connects to the Ignition Gateway over the network and invokes the project creation API or Designer interface. Because the 'Create Project Role(s)' setting is blank, no role check is enforced and the project is created successfully. The attacker then populates the project with malicious tag bindings or scripted actions to interfere with monitored industrial processes, achieving an impact that exceeds their intended authorization. No public proof-of-concept code has been identified.