CVE-2026-92817

Summary

The Ignition Perspective module fails to properly validate session privileges when determining Designer-level access, allowing authenticated users with Vision project access to escalate their privileges and gain Designer-level capabilities. This flaw enables attackers to execute arbitrary code in the context of the Ignition Gateway process.

Exploitability

Exploitation is relatively straightforward for authenticated users who have access to a Vision project, requiring only a valid Vision session identifier to gain elevated Designer privileges and execute arbitrary code.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the Ignition Gateway system with high privileges, potentially leading to full system compromise and unauthorized access to connected industrial control systems.

Detection

Monitor for unusual Designer-level access patterns in the Ignition Gateway logs, particularly when Vision session identifiers are used to access Designer features without proper privilege validation.

Prioritized remediation

Upgrade to Ignition 8.1.20 or later, which includes a fix for this privilege escalation vulnerability in the Perspective module.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.