eMudhra Intermediate CA Key Compromise: Impact on Ignition

On October 20, 2026, eight eMudhra intermediate CA certificates were publicly reported as compromised. Ignition is affected: the Java runtime bundled with the Gateway, Designer, Vision Client, launchers, and Workstation currently trusts these certificates, and current Java releases do not yet block them. An attacker who can intercept or redirect an Ignition component's HTTPS connections can impersonate any server to that component, and read or change its traffic, until the component's trust store blocks the compromised eMudhra certificates. We have no indication that Ignition installations have been targeted.

We are aware of the issue and are preparing guidance. Detailed instructions will follow. If your environment requires immediate action, contact ignition-security@inductiveautomation.com for a stopgap mitigation.

Perspective mobile apps rely on the mobile OS trust store and are protected once iOS or Android is up to date.

This post will be updated as the situation develops.
-------------------------------------------------------------------End update------------------------------------------------------

Background

Ignition by Inductive Automation does not use Oracle Java. Ignition bundles a commercially licensed distribution of Azul Zulu JDK, which receives quarterly security updates aligned with the Java Critical Patch Update (CPU) cycle. Once a new Azul Zulu release is available and validated, Inductive Automation integrates and tests it prior to inclusion in an Ignition release.

The following CVEs were identified in Java versions prior to the April 21, 2026 release and could apply to Ignition 8.3.6 and earlier. None are tested or acknowledged Ignition-specific vulnerabilities. Issues of that nature are handled with priority and receive a dedicated security advisory and CVE assignment under Inductive Automation, and should be reported to security@inductiveautomation.com.

JRE Affected CVEs

Resolution

These vulnerabilities are not known to affect Ignition. However, Inductive Automation will address the underlying vulnerabilities by including Azul Zulu Java 17.0.19 in Ignition 8.3.8. Customers running security scans against Ignition 8.3.6 or earlier may observe these CVEs flagged against the bundled JVM. This advisory can be referenced in scan exception documentation.

Sources: Azul Zulu CVE History | April 2026 Release Notes (PDF)

Inductive Automation and the EU Cyber Resilience Act

Inductive Automation is committed to meeting the requirements of the EU Cyber Resilience Act (CRA), a condition of continuing to sell Ignition in the EU. We take this seriously. We believe the work will benefit every Ignition customer, not just those in the EU.

Initial CRA compliant version of Ignition

We will offer an initial CRA compliant version of Ignition ahead of the December 11, 2027 deadline. We'll announce the specific version as plans are finalized. This will be a standard Ignition release, not a separate product: same licensing, same costs.

For customers, the path is simple. CRA requirements apply to versions of Ignition placed on the market after December 11, 2027, so you can keep running earlier versions for as long as needed. When you're ready to upgrade, a CRA compliant version will be available. No disruption is required.

Vulnerability disclosure and reporting

Inductive Automation already operates a coordinated vulnerability disclosure program. We coordinate directly with CISA. Our findings are formally scored and cataloged in the NIST National Vulnerability Database for the broader security community. We are prepared to meet the ENISA coordinated vulnerability disclosure reporting requirements when they take effect in September 2026, in addition to these current practices.

Long term support and free security updates

We're formalizing how Long Term Support will work with our upcoming Ignition 2027 release, and we're excited about what it will bring. We know our customers plan on long horizons, and we want to make that possible, with periodic upgrades along the way. Whatever form LTS takes, one key detail is already settled: CRA compliant versions of Ignition will receive free security updates as required by the CRA, for a minimum of five years from market placement, regardless of support contracts or LTS status.

Getting it right

We're working with qualified outside consultants to make sure our CRA program is done right and on schedule. We'll share more details here as milestones are reached.

If you noticed Ignition CVE-2025-13911, you're probably wondering what this means for you.

The default Ignition installation on Windows grants greater operating system permissions than is needed in most cases. An Ignition administrator importing malicious project resources could lead to a system level compromise or other significant effects.

This Tech Advisory contains more information. Steps #1-#3 correct the issue. The Ignition Security Hardening Guide has been updated with “Appendix A - Restrict the Ignition Service Security” with additional recommendations.

Feel free to reach out to Inductive Automation if you have any additional questions.

PHP2Shell Vulnerabilities: No Impact to Ignition

Ignition is not affected by the critical memory safety vulnerabilities in core PHP, dubbed "PHP2Shell" (CVE-2026-109618, CVE-2026-109619). Ignition is a Java application with its own JRE and does not include, depend on, or execute PHP in any Inductive Automation component, including the Gateway, Designer, Vision Client, Perspective, launchers, and Workstation. No customer action is required.

Bouncy Castle: CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588

Ignition 8.1.54 and 8.3.8 bundle Bouncy Castle 1.78.1, which appears in the affected range for CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588. Dependency scanners flag the library on that basis. Inductive Automation has reviewed these against Ignition 8.1 and 8.3 code and confirmed none is exploitable in Ignition.

CVE-2025-14813 (GOST 28147 CTR): Ignition does not use the GOST cipher in any mode. No product code references it, and every cipher operation in the product uses a fixed AES, 3DES, or RSA algorithm. The affected class ships in the library but is not reachable from Ignition's own code.

CVE-2025-8916, CVE-2026-0636, and CVE-2026-5588: each depends on a Bouncy Castle code path that Ignition does not use. Certificate validation and signature verification run through the JDK, not the affected components.

Inductive Automation is updating Bouncy Castle to 1.85+. Detailed per CVE analysis is available under NDA. No action needed. A Trust Center post will be submitted when fixes are available, expected on the next normal release cycle.

CISA published an ICSA-26-286-01 news update with CVE-2026-92817. Inductive Automation recommends updating to Ignition 8.1.55 / 8.3.9 or newer to fix the issue.

Inductive Automation thanks Tim Hemingway and Abhinav Agarwal (independently) for reporting these vulnerabilities through our coordinated vulnerability disclosure program.

Inductive Automation recommends updating to Ignition 8.1.55 or 8.3.9, which include security updates addressing two vulnerabilities: 

CVE-2026-92817 (CVSS 8.8, high). An authenticated remote code execution vulnerability in the Ignition Gateway. Under certain conditions, an authenticated user could execute arbitrary code in the Gateway process, which could lead to compromise of the Gateway host, including access to Gateway credentials and connected databases and devices. A CVE identifier will be assigned and published with this advisory. 

CVE‑2026‑63252 (CVSS 7.5, high). A denial of service vulnerability. A successful exploit could cause memory exhaustion on the Ignition Gateway, resulting in loss of availability; confidentiality and integrity of data are not affected. 

All Ignition 8.1 releases prior to 8.1.55 and all 8.3 releases prior to 8.3.9 are affected by both issues.  

For environments where an immediate upgrade is not possible, customers should follow the guidance in the Ignition Security Hardening Guide, including restricting network exposure of the Ignition Gateway, maintaining network segmentation, and limiting Gateway access to trusted users and hosts. These measures reduce exposure but do not remediate the vulnerabilities; upgrading remains the recommended action. 

Inductive Automation thanks Tim Hemingway and Abhinav Agarwal for reporting these vulnerabilities through our coordinated vulnerability disclosure program. 

Questions or concerns may be directed to security@inductiveautomation.com.
Updated: 9/17-26 to include the assigned CVE.

Permissive default in Create Project permissions. In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

Recommendation: upgrade to 8.1.54 or later (or the latest 8.3 version). If you must remain on an earlier 8.1 version, set "Create Project Role(s)" to match your Designer Role. See Gateway General Security Settings.

https://docs.inductiveautomation.com/docs/8.1/platform/security/gateway-general-security-settings#gateway-security-settings-table

Update. This is published as CVE-2026-77393 (fixed in 8.1.54, not applicable to 8.3). See CISA Advisory

Acknowledgment: Inductive Automation thanks Christopher Lusk (North Echo Security Research) for reporting this issue, which was remediated in 8.1.54, and Elhussain Fathy (0xSphinx) for an independent report and confirmation of the fix.