Inductive Automation Ignition Gateway Blank Default Create Project Role Privilege Escalation

CVE-2026-77393 affects Inductive Automation Ignition ≤8.1.53, a widely deployed ICS/SCADA platform used by 65% of Fortune 100 companies across critical manufacturing, energy, and water sectors. The Gateway's Create Project Role(s) setting shipped blank — meaning *no role restriction was enforced* on project creation. Any authenticated user who can reach the Gateway and execute gateway scripts can create projects containing arbitrary scripts. Because the Ignition Gateway service runs as SYSTEM (Windows) or root (Linux) by default, malicious project scripts execute at the highest privilege level on the host, giving an attacker full control of the SCADA gateway. The fix in 8.1.54 restricts project creation to Designer sessions only. The 8.3 series was never affected.

The CNA (CISA ICS-CERT) scored this 8.8 HIGH via CVSS 3.1 — and for an ICS/SCADA platform, that score is *defensible*. The blank-by-default configuration is trivially exploitable once authenticated, and the blast radius on an Ignition gateway is not just a single host: it's the supervisory layer controlling physical industrial processes. However, the authentication requirement (PR:L) and the expectation that Ignition gateways sit on segmented OT networks — not the open internet — introduce real friction that prevents this from reaching CRITICAL in most deployments. A simple one-line configuration change (setting Create Project Roles to the Designer Role) fully mitigates without patching, which further reduces urgency. noisgate assesses this at HIGH 7.5, acknowledging the OT safety floor while crediting the authentication gate and easy workaround.

Why this verdict

• Authentication gate: The vulnerability requires valid Ignition credentials (PR:L). This is not an unauthenticated RCE — the attacker must already possess or have stolen a valid account, which represents a prior compromise stage.
• OT network segmentation: Ignition gateways should reside on segmented OT networks per IEC 62443 and CISA guidance. Reaching the Gateway requires either OT network access (implying the attacker is already deep inside the environment) or a misconfigured flat network.
• Trivial workaround available: Setting the 'Create Project Role(s)' field to the Designer Role fully mitigates the vulnerability without applying any software patch — a 30-second configuration change.
• Role multiplier (OT/ICS/SCADA — floor: HIGH): Ignition is deployed as SCADA supervisory software in critical manufacturing, energy, and water sectors. Virtually 100% of Ignition installs occupy the OT/ICS high-value role by definition. Compromise of the Gateway running as SYSTEM/root yields control of the supervisory layer, with blast radius extending to connected PLCs, RTUs, and field devices — potentially causing physical safety impacts. This floors the verdict at HIGH regardless of friction.
• No exploitation evidence: No KEV listing, no public PoC, no observed campaigns. The vulnerability is a default-configuration issue that has existed since Ignition 8.1's release (Nov 2020), and no exploitation has been reported over ~6 years of exposure.

Why not higher?

CRITICAL would require either unauthenticated remote exploitation or active in-the-wild exploitation. This vulnerability requires valid credentials (PR:L), limiting the attacker pool to insiders or post-compromise scenarios. The one-line configuration workaround also substantially reduces urgency — defenders can mitigate in seconds without waiting for a patch cycle. No KEV listing, no public PoC, and no observed campaigns further argue against CRITICAL.

Why not lower?

MEDIUM or below would ignore the canonical OT/ICS blast radius. Ignition IS the SCADA supervisory layer — this is not a low-value workstation vulnerability. The blank default has existed for ~6 years across a platform deployed at 65% of Fortune 100 companies, meaning a large population of unpatched gateways exists. The SYSTEM/root execution privilege and the ability to manipulate industrial processes from a single compromised account create an outsized impact that the role-multiplier floor captures.

1. Set 'Create Project Role(s)' to your Designer Role immediately — This is the single most effective mitigation — a one-line Gateway configuration change that fully blocks the attack path without patching. Navigate to Gateway → Config → Security → General and populate the blank field with your Designer role. Deploy within the noisgate HIGH mitigation SLA of 30 days, though given the simplicity, same-day is achievable.
2. Restrict Designer and Gateway API access to engineering workstations only — Use host-based firewall rules or network ACLs to limit connections to ports 8088/8043 to known engineering workstation IPs. This limits the population of users who could exploit the blank default, even if it remains unpatched.
3. Audit Ignition user accounts and remove unnecessary access — Review all Ignition Gateway user accounts. Remove or disable accounts that do not require project creation or Designer access. Apply principle of least privilege — operators viewing HMIs should not have Gateway scripting capabilities.
4. Deploy OT network monitoring for anomalous project creation — Configure Ignition audit log forwarding to your SIEM. Alert on ProjectCreated events from non-engineering user accounts or outside maintenance windows. Tools like Claroty, Nozomi, or Dragos can provide additional OT-layer visibility.
5. Run Ignition service under a restricted account instead of SYSTEM/root — Reduces blast radius if the vulnerability is exploited — the attacker inherits a limited service account rather than full OS privileges. This is a defense-in-depth measure that requires testing with your specific Ignition modules.

Run this script on the Ignition Gateway host (Linux) or adapt for Windows. Requires read access to the Ignition installation directory. Invoke as: bash check_cve_2026_77393.sh /usr/local/bin/ignition (pass your Ignition install path as the first argument). No root required — just file-read access to the Gateway config.

#!/usr/bin/env bash
# CVE-2026-77393 Checker for Inductive Automation Ignition
# Checks: (1) Ignition version <= 8.1.53, (2) blank Create Project Role(s)
# Usage: bash check_cve_2026_77393.sh /path/to/ignition
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

IGN_HOME="${1:-/usr/local/bin/ignition}"
GATEWAY_XML="${IGN_HOME}/data/gateway.xml"

if [ ! -d "$IGN_HOME" ]; then
  echo "UNKNOWN — Ignition install directory not found at $IGN_HOME"
  exit 2
fi

# Check version
VERSION_FILE="${IGN_HOME}/.ignition-version"
if [ -f "$VERSION_FILE" ]; then
  VERSION=$(cat "$VERSION_FILE" | tr -d '[:space:]')
else
  # Try gateway.xml for version info
  VERSION=$(grep -oP 'version="\K[^"]+' "$GATEWAY_XML" 2>/dev/null | head -1 || echo "")
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not determine Ignition version"
  exit 2
fi

echo "Detected Ignition version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Check if version is in the affected range (8.1.x where x <= 53)
if [ "$MAJOR" -eq 8 ] && [ "$MINOR" -eq 1 ]; then
  if [ "${PATCH:-0}" -le 53 ]; then
    echo "Version $VERSION is in the affected range (<=8.1.53)"
    # Check if Create Project Role(s) is blank
    if [ -f "$GATEWAY_XML" ]; then
      # Look for the createProjectRoles setting
      ROLE_SETTING=$(grep -i 'createprojectrole' "$GATEWAY_XML" 2>/dev/null || echo "")
      if [ -z "$ROLE_SETTING" ] || echo "$ROLE_SETTING" | grep -qP 'value="\s*"'; then
        echo "VULNERABLE — Ignition $VERSION with blank Create Project Role(s) setting"
        echo "CVE-2026-77393: Default permissions allow any authenticated user to create projects"
        echo "FIX: Set Create Project Role(s) to your Designer Role, or upgrade to 8.1.54+"
        exit 1
      else
        echo "PATCHED — Version is affected but Create Project Role(s) has been configured"
        echo "Workaround is in place. Consider upgrading to 8.1.54+ for a permanent fix."
        exit 0
      fi
    else
      echo "UNKNOWN — could not read gateway.xml at $GATEWAY_XML"
      exit 2
    fi
  else
    echo "PATCHED — Ignition $VERSION is 8.1.54 or later"
    exit 0
  fi
elif [ "$MAJOR" -eq 8 ] && [ "$MINOR" -ge 3 ]; then
  echo "PATCHED — Ignition 8.3+ is not affected by CVE-2026-77393"
  exit 0
else
  echo "UNKNOWN — unexpected version $VERSION; manual review recommended"
  exit 2
fi

Sources

1. CISA ICS Advisory ICSA-26-246-06
2. Inductive Automation Trust Center
3. ZDI — Pwn2Own Miami Ignition Exploitation (2020)
4. CVE Details — Ignition Vulnerability History
5. CISA Internet Exposure Reduction Guidance
6. Security Boulevard — OT Security News Sept 4, 2026
7. Inductive Automation — Ignition SCADA Platform