A privilege escalation bug in Ignition, the industrial control platform, lets low-level users grant themselves admin access.
CISA published an advisory this week for a high-severity flaw in Inductive Automation's Ignition software, which runs control systems at factories and utilities. The bug, tracked as CWE-863 for incorrect authorization, carries a CVSS 3.1 score of 8.8 out of 10. An authenticated user with only low-level permissions can exploit it remotely, without any user interaction, to gain full read, write, and availability impact. Researcher Tim Hemingway reported the flaw to Inductive Automation, which fixed it in version 8.3.9 and, separately, in version 8.1.55.
Ignition sits underneath plenty of industrial processes, so a bug that turns a low-trust account into an admin account is not a theoretical risk. It is a shortcut to controlling real equipment. CISA reports no known public exploitation so far, but that is small comfort on ICS networks where patching means scheduled downtime, not a quick restart.
The fix for the 8.3 branch has been sitting in version 8.3.9 since August 2025. This advisory is less a fire alarm than a reminder that plenty of plants still haven't gotten around to installing it.