noindex and left out of the sitemap until more data is confirmed.CVE-2026-92817 is an incorrect-authorization flaw in the Perspective module of Inductive Automation's Ignition SCADA/HMI platform that may let an authenticated Vision-project user escalate to Designer-level privileges and potentially run arbitrary code in the Ignition Gateway process; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-14
Published
Vulnerability ID: CVE-2026-92817 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Inductive Automation Ignition | — | 8.1.0 through 8.1.54 (fixed in 8.1.55); 8.3.0 through 8.3.8 (fixed in 8.3.9); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-92817 is an incorrect authorization weakness (CWE-863) in the Perspective module of Ignition, Inductive Automation's widely deployed SCADA/HMI and industrial-integration platform. CISA's advisory states the module "does not properly validate session privileges when determining Designer-level access," so "an authenticated user with access to a Vision project" can leverage their own session to gain Designer-level privileges, which could in turn allow arbitrary code execution inside the Ignition Gateway process (CISA ICS Advisory ICSA-26-286-01).
NVD tracks CVE-2026-92817 with status "Awaiting Analysis" as of 2026-10-22: it records Inductive Automation's own CNA-submitted scores — CVSS v3.1 8.8 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4.0 8.7 — but has not published its own independent score or CPE applicability statement, so this page leaves cvss_score unset rather than presenting the vendor's figure as NVD-confirmed (NVD).
Inductive Automation's own security advisory lists the fix: Ignition 8.1.55 (for the 8.1.x line) and 8.3.9 (for the 8.3.x line), both already released as of this advisory's publication (Inductive Automation Security Advisory; CISA ICS Advisory ICSA-26-286-01).
CISA's advisory reports no known public exploitation of this CVE as of its release. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.00484 (40.7th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, Ignition users on 8.1.0–8.1.54 or 8.3.0–8.3.8 with Vision and Perspective both enabled should update to 8.1.55 or 8.3.9 respectively.
Evidence
- Ignition's Perspective module fails to validate session privileges for Designer-level access, letting an authenticated Vision-project user escalate to Designer privileges and potentially execute arbitrary code in the Gateway process (CWE-863). — CISA ICS Advisory ICSA-26-286-01
- NVD status is "Awaiting Analysis" with Inductive Automation-submitted CVSS v3.1 8.8 and CVSS v4.0 8.7; no NVD-published score or CPE configuration as of 2026-10-22. — NVD
- Affects Ignition 8.1.0 through 8.1.54 (fixed in 8.1.55) and 8.3.0 through 8.3.8 (fixed in 8.3.9). — Inductive Automation Security Advisory
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.00484 (40.7th percentile) as of 2026-10-22. — FIRST EPSS
