Inductiveautomation

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Inductiveautomation product.

RSS Feeds for Inductiveautomation security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Inductiveautomation products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Inductiveautomation Sorted by Most Security Vulnerabilities since 2018

Inductiveautomation Ignition30 vulnerabilities

Inductiveautomation Ignition Gateway5 vulnerabilities

By the Year

In 2026 there have been 1 vulnerability in Inductiveautomation with an average score of 6.3 out of ten. Last year, in 2025 Inductiveautomation had 1 security vulnerability published. At the current rates, it appears that the number of vulnerabilities last year and this year may equal out. Last year, the average CVE base score was greater by 0.10

Year	Vulnerabilities	Average Score
2026	1	6.30
2025	1	6.40
2024	18	8.63
2023	0	0.00
2022	10	8.19
2021	0	0.00
2020	5	7.50

It may take a day or so for new Inductiveautomation vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Inductiveautomation Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-13913	Mar 12, 2026	UnAuth API endpoint allows password-Reset email change in Ignition <8.3.0 A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded malicious code.	Ignition
CVE-2025-13911	Dec 18, 2025	Ignition SCADA Unrestricted Python Imports Allow SYSTEMLevel Code Execution Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via the gateway backup restore functionality. An authenticated user with Gateway Administrator privileges can import a malicious gateway backup (.gwbk) file containing crafted project resources, scripts, or modules, resulting in code execution on the host system. This affects both Windows and Linux installations. On Windows, default installations often run the Ignition service as NT AUTHORITY\SYSTEM, resulting in code execution with full local system privileges. On Linux, default installations commonly run the Ignition service as root or with elevated privileges. Specific privilege level depends on installation configuration.	Ignition
CVE-2023-50220	May 03, 2024	Ignition Base64Element Deserialization RCE Vulnerability Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the Base64Element class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21801.	Ignition
CVE-2023-50219	May 03, 2024	Ignition RunQuery Deserialization RCE in Inductive Automation Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the RunQuery class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21625.	Ignition
CVE-2023-50233	May 03, 2024	Inductive Automation Ignition getJavaExecutable DT/RCE Vulnerability Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the getJavaExecutable method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22029.	Ignition
CVE-2023-50232	May 03, 2024	Ignition getParams Arg Injection Remote Code Execution Vulnerability Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the getParams method. The issue results from the lack of proper validation of a user-supplied string before using it to prepare an argument for a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22028.	Ignition
CVE-2023-50223	May 03, 2024	Inductive Automation Ignition ExtendedDocumentCodec Deserialization RCE Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExtendedDocumentCodec class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22127.	Ignition
CVE-2023-50222	May 03, 2024	Ignition RCE via ResponseParser Untrusted Deserialization Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22067.	Ignition
CVE-2023-50221	May 03, 2024	Ignition ResponseParser RCE: Deserialization of Untrusted Data Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The specific flaw exists within the ResponseParser method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21926.	Ignition
CVE-2023-50218	May 03, 2024	Ignition ModuleInvoke RCE via Deserialization of Untrusted Data Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability. The specific flaw exists within the ModuleInvoke class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21624.	Ignition