CVE-2026-77393Patch

MEDIUMCVSS 8.7 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-276

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-09-03); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

Patch

133.3%

Active Exploitation

133.3%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-03	1	Patch1
2026-09-04	1	Active Exploitation1
2026-09-05	1	Disclosure1

Full discourse3 posts

ADK Cyber@ADKCyber44d
Disclosure
Ignition 8.1.53 and earlier has a high-severity issue (CVE-2026-77393, CVSS 8.8) where blank Gateway settings may allow project creation by authenticated users. Review your config: https://nvd.nist.gov/vuln/deta… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/N2gDVRY1ME
Post summary
The tweet announces CVE‑2026‑77393 affecting Ignition 8.1.53 and earlier, giving technical details and a CVSS score but no evidence of exploits, PoC, patch, or real‑world usage.
0000032
93 followersView on X
Aviatrix Threat Research Center@aviatrixtrc45d
Active Exploitation
TRC analysis shows attackers exploited CVE-2026-77393 in Inductive Automation Ignition SCADA systems to escalate from authenticated users to project creators with gateway script execution. The configuration flaw enabled lateral movement across OT/IT networks in critical infrastructure environments. #CloudSecurity #ThreatIntel 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/inductive-automation-ignition-cve-2026-77393-incorrect-default-permissions
Post summary
Attackers have exploited CVE‑2026‑77393 in Inductive Automation Ignition SCADA systems to elevate privileges and execute gateway scripts, enabling lateral movement across critical infrastructure networks.
0000053
2.0K followersView on X
NewsTongue@NewsTongueX46d
Patch
🔴 Inductive Automation patches project-creation flaw in Ignition <=8.1.53 Inductive Automation Ignition versions 8.1.53 and earlier contain CVE-2026-77393, which allows any authenticated user to create projects due to a blank default configuration in the Gateway 'Create Project Role(s)' setting. The vulnerability affects critical infrastructure in manufacturing, energy, and IT sectors worldwide. Inductive Automation released version 8.1.54, which restricts project creation to Designer sessions and removes reliance on the vulnerable setting. The 8.3 series is unaffected.
Post summary
The post announces that Inductive Automation has patched CVE‑2026‑77393 by releasing version 8.1.54, which restricts project creation to Designer sessions and eliminates the vulnerable default configuration.
0000047
851 followersView on X

Explore more

Back to dashboard