Quick answers
- Is CVE-2026-77393 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-77393 being exploited in the wild.
- How severe is CVE-2026-77393?
- High severity, with a CVSS score of 8.8, published 4 September 2026.
- Which products and versions are affected?
- Inductive Automation Ignition 8.1.53 and earlier.
- Is there a fix for CVE-2026-77393?
- A patch was published on 8.1.54. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-77393 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-77393?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in the Gateway "Create Project Role(s)" setting, which shipped blank in Ignition 8.1.53 and earlier. This blank configuration allowed any authenticated user to create projects if they could execute gateway scripts, circumventing the intended role-based access control. The attack requires network access to the Ignition gateway and prior authentication; an attacker cannot exploit this unauthenticated. Ignition 8.1.54 remediated the issue by restricting project creation exclusively to Designer sessions and removing reliance on the vulnerable setting. The 8.3 series was not affected by this flaw.
Affected products
- Inductive Automation Ignition 8.1.53 and earlier
Timeline
- 2026-09-04: disclosed
- 8.1.54: patched