Loading story…
CISA and the Canadian Centre for Cyber Security warned that CVE-2026-77393 affects Inductive Automation Ignition 8.1.53 and earlier. The high-severity incorrect-default-permissions flaw, rated CVSS 8.8, leaves the Gateway Create Project Role(s) setting blank by default, enabling authenticated users who can execute Gateway scripts to create projects.
Inductive Automation recommends upgrading to Ignition 8.1.54 or later or to the latest 8.3 release. Organizations that must remain on earlier 8.1 versions can mitigate the issue by assigning Create Project Role(s) to the appropriate Designer Role; CISA reported no known public exploitation targeting the vulnerability at publication.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-892 concerning the vulnerability affecting Inductive Automation Ignition 8.1.53 and earlier. It advised users and administrators to review the referenced CISA and CSAF guidance and apply relevant updates when available.
CISA published ICSA-26-246-06 describing CVE-2026-77393, a High-severity incorrect-default-permissions flaw affecting Ignition 8.1.53 and earlier. A blank Gateway "Create Project Role(s)" setting could allow authenticated users able to execute Gateway scripts to create projects; upgrades to 8.1.54 or later, or the 8.3 series, were recommended.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcetenable.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Honeywell IQ4x building management system (BMS) controllers** were reported to expose their full web-based HMI **without authentication in factory-default configurations**, tracked as **CVE-2026-3611**. When no web user module is configured, the device operates under a **System Guest (level 100)** context that can provide read/write access to anyone who can reach the HTTP interface; authentication is only enforced after a user is created. Because the user-creation function (via `U.htm`) is reachable prior to authentication, a remote attacker can create an administrative account, enable the user module under attacker-controlled credentials, and potentially **lock out legitimate operators**, with impacts including unauthorized access to management settings, component control, information disclosure, and denial of service. This is **not fluff**; it is a concrete ICS/OT vulnerability disclosure with clear exploitation conditions and operational impact. However, several other items in the set are separate CISA ICS advisories for different products and CVEs (Inductive Automation Ignition deserialization leading to code execution; Apeman camera issues enabling device takeover/viewing feeds; and multiple Lantronix EDS vulnerabilities including auth bypass and root-level command injection) and should be treated as **distinct security stories** rather than part of the Honeywell IQ4x event.
Jun 29, 2026
CISA published an ICS advisory for **CVE-2026-3437**, a **high-severity** memory safety issue (*CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer*) affecting **Portwell Engineering Toolkits v4.8.2**. The flaw is in the Portwell Engineering Toolkits **driver** and could allow a **local, authenticated attacker** to **read and write arbitrary memory**, enabling **privilege escalation** or **denial of service**; CISA scored it **CVSS v3.1 8.8 (High)** with a local attack vector and low complexity. The CVE record corroborates the same impact and affected version, and additionally lists a **CVSS v4.0** vector consistent with high impact to confidentiality, integrity, and availability. The vulnerability was reported to CISA by **Jason Huang** of **TXOne Networks** (Cyber Threat & Product Defense Center), and the advisory notes deployment across critical infrastructure environments (including **Energy** and **Critical Manufacturing**) with worldwide exposure.
Jun 29, 2026
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions disclosed multiple vulnerabilities affecting **ICONICS Suite**, **GENESIS64**, **GENESIS32**, **MC Works64**, and related products used in industrial and manufacturing environments. CISA said the flaws include **deserialization-based remote code execution**, **path traversal**, inclusion of functionality from an untrusted control sphere, and an **out-of-bounds read** that could lead to information disclosure or denial of service. The most severe issue carries a **CVSS v3.1 score of 9.8**, and affected versions include GENESIS64 and ICONICS Suite `10.97` through `10.97.1`, **MC Works64** up to `4.04E`, and **GENESIS32** up to `9.7`. A separate updated advisory also detailed an **information tampering** flaw caused by execution with unnecessary privileges across additional ICONICS-related products, including **MobileHMI**, **Hyper Historian**, **AnalytiX**, **IoTWorX**, **GENESIS**, and **BizViz**. CISA said a low-privileged local attacker could create a symbolic link and abuse service file writes to overwrite arbitrary files, potentially destroying files and causing denial of service, a weakness tracked under **CWE-250** and rated **CVSS 6.5**. Vendor fixes are available for several current product lines, including version `10.98` or later for GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, and AnalytiX, version `10.96` or later for IoTWorX, and version `11.01` or later for GENESIS, while no fixes are planned for some legacy products such as **MC Works64**, **GENESIS32**, and **BizViz**; operators are urged to isolate affected systems, restrict remote and physical access, and use firewalls or VPNs.
Jun 29, 2026