---
title: CISA ICSA-26-286-01: Ignition CVE-2026-92817 lets Vision users escalate to Perspective Designer / Gateway RCE (CVSS 8.8) | ctxsec
url: https://ctxsec.com/items/ignition-cve-2026-92817-icsa
description: ""
status: "confirmed (CISA)"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ignition-cve-2026-92817-icsa.md)

confirmed (CISA)

2026-10-13

### CISA ICSA-26-286-01: Ignition CVE-2026-92817 lets Vision users escalate to Perspective Designer / Gateway RCE (CVSS 8.8)

CISA ICS advisory ICSA-26-286-01 (released Oct 13) covers Inductive Automation Ignition. The Perspective module does not properly validate session privileges for Designer-level access: an authenticated Vision user can present a valid Vision session identifier and obtain Designer privileges, then execute arbitrary code in the Ignition Gateway process (CWE-863). Affected: Ignition 8.1.0–8.1.54 and 8.3.0–8.3.8. Fixed: 8.1.55 (Sep 2026) and 8.3.9 (Aug 2025). CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N). Reported to the vendor by Tim Hemingway. Pair with network isolation of Gateway/Designer interfaces and least-privilege Vision project accounts.

Sources: [CISA ICSA-26-286-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-01) · [CISA CSAF JSON](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-286-01.json) · [CVE-2026-92817](https://www.cve.org/CVERecord?id=CVE-2026-92817)