Snapshot 223356
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center Overview Welcome to the Inductive Automation Trust Portal Thousands of companies worldwide depend on Ignition See Founder’s Message and Company Leadership Customers, Case Studies, Projects, Discover Gallery SDLC guide. (Duo/CrowdStrike) case studies ** Subscribe to Trust Center Updates ** (below) Vuls/contact: security@inductiveautomation.com (PGP) Compliance ISO 9001:2015 ISA 62443 ISO/IEC 27001 ISO 14001:2015 21 CFR Part 11 NIST 800-218 CMMC Certified ISO 45001:2018 Product Security Audit Logging Coordinated Vulnerability Disclosure Data Security View more Reports Ignition Security Hardening Guide Pentest Reports Self-Assessments Other Self-Assessments SIG Lite Data Security Access Monitoring Data Backups Data Erasure View more App Security Software Development Lifecycle Software Bill of Materials (SBOM) Code Analysis View more AI AI Overview How Our Security Program Is Adapting to AI Third-Party AI Diligence (IA Internal Tools) Access Control Data Access Logging Password Security Infrastructure Amazon Web Services Anti-DDoS Data Center View more Endpoint Security Disk Encryption DNS Filtering Endpoint Detection & Response View more Network Security Firewall IDS/IPS Security Information and Event Management View more Corporate Security Asset Management Practices Email Protection Employee Training View more Security Grades Qualys SSL Labs inductiveautomation.com A account.inductiveautomation.com A forum.inductiveautomation.com A+ docs.inductiveautomation.com A+ inductiveuniversity.com A icc.inductiveautomation.com A api.inductiveautomation.com A+ licenses.inductiveautomation.com A+ support.inductiveautomation.com A+ Trust Center Updates Java Runtime (JRE) Security Advisories Vulnerabilities eMudhra Intermediate CA Key Compromise: Mitigation Scripts Available Scripts that remove the eMudhra and AAA Certificate Services roots from every Java runtime bundled with Ignition (Gateway, Designer, Vision Client, launchers, Workstation) are now available at github.com/inductiveautomation/ignition-emudhra-mitigation. The v2.0.0 release includes a Windows PowerShell script signed by Inductive Automation, LLC, a Linux/macOS script, and SHA-256 checksums. This follows Oracle's guidance at ops.java/emudhra. Run the script on every Gateway, and on every workstation that runs a launcher or Workstation, then restart the Gateway and relaunch clients. Removing these roots also stops trust in any server whose certificate chains only to one of them, including any eMudhra issued, so check your outbound HTTPS dependencies first. A backup is kept for rollback. Upcoming 8.1 and 8.3 maintenance releases will bundle a runtime with the fix. Discussion and updates: Ignition Security Notices forum. Questions: ignition-security@inductiveautomation.com. We have no indication that Ignition installations have been targeted. eMudhra Intermediate CA Key Compromise: Impact on Ignition On October 20, 2026, eight eMudhra intermediate CA certificates were publicly reported as compromised. Ignition is affected: the Java runtime bundled with the Gateway, Designer, Vision Client, launchers, and Workstation currently trusts these certificates, and current Java releases do not yet block them. An attacker who can intercept or redirect an Ignition component's HTTPS connections can impersonate any server to that component, and read or change its traffic, until the component's trust store blocks the compromised eMudhra certificates. We have no indication that Ignition installations have been targeted. We are aware of the issue and are preparing guidance. Detailed instructions will follow. If your environment requires immediate action, contact ignition-security@inductiveautomation.com for a stopgap mitigation. Perspective mobile apps rely on the mobile OS trust store and are protected once iOS or Android is up to date. This post will be updated as the situation develops. -------------------------------------------------------------------End update------------------------------------------------------ Background Ignition by Inductive Automation does not use Oracle Java. Ignition bundles a commercially licensed distribution of Azul Zulu JDK, which receives quarterly security updates aligned with the Java Critical Patch Update (CPU) cycle. Once a new Azul Zulu release is available and validated, Inductive Automation integrates and tests it prior to inclusion in an Ignition release. The following CVEs were identified in Java versions prior to the April 21, 2026 release and could apply to Ignition 8.3.6 and earlier. None are tested or acknowledged Ignition-specific vulnerabilities. Issues of that nature are handled with priority and receive a dedicated security advisory and CVE assignment under Inductive Automation, and should be reported to security@inductiveautomation.com. JRE Affected CVEs CVE Component Remote Exploit (no auth) CVSS Base Attack Vector CVE-2026-22016 JAXP Yes 7.5 Network CVE-2026-20652 JavaFX (WebKitGTK) Yes 7.5 Network CVE-2026-34282 Networking Yes 7.5 Network CVE-2026-22013 JGSS Yes 5.3 Network CVE-2026-22021 JSSE Yes 5.3 Network CVE-2026-23865 2D (FreeType) No 5.3 Local CVE-2026-22018 Libraries Yes 3.7 Network CVE-2026-22008 Libraries Yes 3.7 Network CVE-2026-22007 Security No 2.9 Local CVE-2026-34268 Security No 2.9 Local CVE-2026-22003 Hotspot No 6.0 Local Resolution These vulnerabilities are not known to affect Ignition. However, Inductive Automation will address the underlying vulnerabilities by including Azul Zulu Java 17.0.19 in Ignition 8.3.8. Customers running security scans against Ignition 8.3.6 or earlier may observe these CVEs flagged against the bundled JVM. This advisory can be referenced in scan exception documentation. Sources: Azul Zulu CVE History | April 2026 Release Notes (PDF) EU Cyber Resilience Act (CRA) Compliance Inductive Automation and the EU Cyber Resilience Act Inductive Automation is committed to meeting the requirements of the EU Cyber Resilience Act (CRA), a condition of continuing to sell Ignition in the EU. We take this seriously. We believe the work will benefit every Ignition customer, not just those in the EU. Initial CRA compliant version of Ignition We will offer an initial CRA compliant version of Ignition ahead of the December 11, 2027 deadline. We'll announce the specific version as plans are finalized. This will be a standard Ignition release, not a separate product: same licensing, same costs. For customers, the path is simple. CRA requirements apply to versions of Ignition placed on the market after December 11, 2027, so you can keep running earlier versions for as long as needed. When you're ready to upgrade, a CRA compliant version will be available. No disruption is required. Vulnerability disclosure and reporting Inductive Automation already operates a coordinated vulnerability disclosure program. We coordinate directly with CISA. Our findings are formally scored and cataloged in the NIST National Vulnerability Database for the broader security community. We are prepared to meet the ENISA coordinated vulnerability disclosure reporting requirements when they take effect in September 2026, in addition to these current practices. Long term support and free security updates We're formalizing how Long Term Support will work with our upcoming Ignition 2027 release, and we're excited about what it will bring. We know our customers plan on long horizons, and we want to make that possible, with periodic upgrades along the way. Whatever form LTS takes, one key detail is already settled: CRA compliant versions of Ignition will receive free security updates as required by the CRA, for a minimum of five years from market placement, regardless of support contracts or LTS status. Getting it right We're working with qualified outside consultants to make sure our CRA program is done right and on schedule. We'll share more details here as milestones are reached. CVE-2025-13911 (Ignition Windows Default) Vulnerabilities If you noticed Ignition CVE-2025-13911, you're probably wondering what this means for you. The default Ignition installation on Windows grants greater operating system permissions than is needed in most cases. An Ignition administrator importing malicious project resources could lead to a system level compromise or other significant effects. This Tech Advisory contains more information. Steps #1-#3 correct the issue. The Ignition Security Hardening Guide has been updated with “Appendix A - Restrict the Ignition Service Security” with additional recommendations. Feel free to reach out to Inductive Automation if you have any additional questions. Ignition Software: Library Vulns / Updates Vulnerabilities PHP2Shell Vulnerabilities: No Impact to Ignition Ignition is not affected by the critical memory safety vulnerabilities in core PHP, dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619). Ignition is a Java application with its own JRE and does not include, depend on, or execute PHP in any Inductive Automation component, including the Gateway, Designer, Vision Client, Perspective, launchers, and Workstation. No customer action is required. Bouncy Castle: CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588 Ignition 8.1.54 and 8.3.8 bundle Bouncy Castle 1.78.1, which appears in the affected range for CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588. Dependency scanners flag the library on that basis. Inductive Automation has reviewed these against Ignition 8.1 and 8.3 code and confirmed none is exploitable in Ignition. CVE-2025-14813 (GOST 28147 CTR): Ignition does not use the GOST cipher in any mode. No product code references it, and every cipher operation in the product uses a fixed AES, 3DES, or RSA algorithm. The affected class ships in the library but is not reachable from Ignition's own code. CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588: each depends on a Bouncy Castle code path that Ignition does not use. Certificate validation and signature verification run through the JDK, not the affected components. Inductive Automation is updating Bouncy Castle to 1.85+. Detailed per CVE analysis is available under NDA. No action needed. A Trust Center post will be submitted when fixes are available, expected on the next normal release cycle. Ignition Software Upgrade Recommendations General CISA published an ICSA-26-286-01 news update with CVE-2026-92817. Inductive Automation recommends updating to Ignition 8.1.55 / 8.3.9 or newer to fix the issue. Inductive Automation thanks Tim Hemingway and Abhinav Agarwal (independently) for reporting these vulnerabilities through our coordinated vulnerability disclosure program. Inductive Automation recommends updating to Ignition 8.1.55 or 8.3.9, which include security updates addressing two vulnerabilities: CVE-2026-92817 (CVSS 8.8, high). An authenticated remote code execution vulnerability in the Ignition Gateway. Under certain conditions, an authenticated user could execute arbitrary code in the Gateway process, which could lead to compromise of the Gateway host, including access to Gateway credentials and connected databases and devices. A CVE identifier will be assigned and published with this advisory. CVE‑2026‑63252 (CVSS 7.5, high). A denial of service vulnerability. A successful exploit could cause memory exhaustion on the Ignition Gateway, resulting in loss of availability; confidentiality and integrity of data are not affected. All Ignition 8.1 releases prior to 8.1.55 and all 8.3 releases prior to 8.3.9 are affected by both issues. For environments where an immediate upgrade is not possible, customers should follow the guidance in the Ignition Security Hardening Guide, including restricting network exposure of the Ignition Gateway, maintaining network segmentation, and limiting Gateway access to trusted users and hosts. These measures reduce exposure but do not remediate the vulnerabilities; upgrading remains the recommended action. Inductive Automation thanks Tim Hemingway and Abhinav Agarwal for reporting these vulnerabilities through our coordinated vulnerability disclosure program. Questions or concerns may be directed to security@inductiveautomation.com. Updated: 9/17-26 to include the assigned CVE. Permissive default in Create Project permissions. In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. Recommendation: upgrade to 8.1.54 or later (or the latest 8.3 version). If you must remain on an earlier 8.1 version, set "Create Project Role(s)" to match your Designer Role. See Gateway General Security Settings. https://docs.inductiveautomation.com/docs/8.1/platform/security/gateway-general-security-settings#gateway-security-settings-table Update. This is published as CVE-2026-77393 (fixed in 8.1.54, not applicable to 8.3). See CISA Advisory Acknowledgment: Inductive Automation thanks Christopher Lusk (North Echo Security Research) for reporting this issue, which was remediated in 8.1.54, and Elhussain Fathy (0xSphinx) for an independent report and confirmation of the fix. If you think you may have discovered a vulnerability, please send us a note. Report issue