Inductiveautomation

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Inductiveautomation product.

RSS Feeds for Inductiveautomation security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Inductiveautomation products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Inductiveautomation Sorted by Most Security Vulnerabilities since 2018

Inductiveautomation Ignition30 vulnerabilities

Inductiveautomation Ignition Gateway5 vulnerabilities

By the Year

In 2026 there have been 1 vulnerability in Inductiveautomation with an average score of 6.3 out of ten. Last year, in 2025 Inductiveautomation had 1 security vulnerability published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Inductiveautomation in 2026 could surpass last years number. Last year, the average CVE base score was greater by 0.10

Year	Vulnerabilities	Average Score
2026	1	6.30
2025	1	6.40
2024	18	8.63
2023	0	0.00
2022	10	8.19
2021	0	0.00
2020	5	7.50

It may take a day or so for new Inductiveautomation vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Inductiveautomation Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-13913	Mar 12, 2026	UnAuth API endpoint allows password-Reset email change in Ignition <8.3.0 A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.	Ignition
CVE-2025-13911	Dec 18, 2025	Ignition SCADA Unrestricted Python Imports Allow SYSTEMLevel Code Execution The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence of proper security controls that restrict which Python libraries can be imported and executed within the scripting environment. The core issue lies in the Ignition service account having system permissions beyond what an Ignition privileged user requires. When an authenticated administrator uploads a malicious project file containing Python scripts with bind shell capabilities, the application executes these scripts with the same privileges as the Ignition Gateway process, which typically runs with SYSTEM-level permissions on Windows. Alternative code execution patterns could lead to similar results.	Ignition
CVE-2023-50220	May 03, 2024	Ignition Base64Element Deserialization RCE Vulnerability Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the Base64Element class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21801.	Ignition
CVE-2023-50219	May 03, 2024	Ignition RunQuery Deserialization RCE in Inductive Automation Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the RunQuery class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21625.	Ignition
CVE-2023-50233	May 03, 2024	Inductive Automation Ignition getJavaExecutable DT/RCE Vulnerability Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the getJavaExecutable method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22029.	Ignition
CVE-2023-50232	May 03, 2024	Ignition getParams Arg Injection Remote Code Execution Vulnerability Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the getParams method. The issue results from the lack of proper validation of a user-supplied string before using it to prepare an argument for a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22028.	Ignition
CVE-2023-50223	May 03, 2024	Inductive Automation Ignition ExtendedDocumentCodec Deserialization RCE Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExtendedDocumentCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22127.	Ignition
CVE-2023-50222	May 03, 2024	Ignition RCE via ResponseParser Untrusted Deserialization Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22067.	Ignition
CVE-2023-50221	May 03, 2024	Ignition ResponseParser RCE: Deserialization of Untrusted Data Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21926.	Ignition
CVE-2023-50218	May 03, 2024	Ignition ModuleInvoke RCE via Deserialization of Untrusted Data Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the ModuleInvoke class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21624.	Ignition