# Security Notices **URL:** https://forum.inductiveautomation.com/c/security-notices/65.md [Latest](https://forum.inductiveautomation.com/latest.md) · [Categories](https://forum.inductiveautomation.com/categories.md) · [Tags](https://forum.inductiveautomation.com/tags.md) --- ## [eMudhra Intermediate CA Key Compromise: Interim Mitigation](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation/117596)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 1:22pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation/117596 "2026-10-25T13:22:29Z")
The Trust Center (eMudhra post) is the authoritative source as IA releases official guidance. Overview: Remove the two root certificates the compromised intermediates chain to (“emSign ECC Root CA - G3” and “AAA Certifi… --- ## [Updating Java in Ignition (IA commitment)](https://forum.inductiveautomation.com/t/updating-java-in-ignition-ia-commitment/117599)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 2:49pm UTC](https://forum.inductiveautomation.com/t/updating-java-in-ignition-ia-commitment/117599 "2026-10-25T14:49:19Z")
Ignition ships its own Java runtime (Azul Zulu) and never uses a Java installed on the host. If nothing else on the server needs Java, remove the OS install. Our commitment: every Ignition minor release is eligible for … --- ## [About the Security Notices category](https://forum.inductiveautomation.com/t/about-the-security-notices-category/117595)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 1:08pm UTC](https://forum.inductiveautomation.com/t/about-the-security-notices-category/117595 "2026-10-25T13:08:39Z")
Inductive Automation analysis and position on security news items, dependency CVEs, scanner findings reported against Ignition, especially when Ignition is not affected or risk is assessed as low. We recommend subscribin… --- ## [Security Hardening Guide: 2027 Update and Feedback Request](https://forum.inductiveautomation.com/t/security-hardening-guide-2027-update-and-feedback-request/117605)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:55pm UTC](https://forum.inductiveautomation.com/t/security-hardening-guide-2027-update-and-feedback-request/117605 "2026-10-25T15:55:39Z")
The Ignition Security Hardening Guide is Inductive Automation’s set of implementation recommendations for deploying Ignition securely: Gateway configuration, authentication and authorization, TLS, network placement, and … --- ## [FIPS 140 and Ignition: Current Position](https://forum.inductiveautomation.com/t/fips-140-and-ignition-current-position/117604)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:47pm UTC](https://forum.inductiveautomation.com/t/fips-140-and-ignition-current-position/117604 "2026-10-25T15:47:45Z")
Ignition is not FIPS 140 validated and does not run on a FIPS enforced host. Inductive Automation has not committed to FIPS validation or compliance. Specifically, the Gateway will not start on a host with OS level FIPS… --- ## [Jetty CVEs in Ignition 8.1 (CVE-2026-2332 and others): Fix Targeted for 8.1.56; 8.3 not affected](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603 "2026-10-25T15:33:27Z")
Ignition 8.1 bundles Jetty 12.0.27. Dependency scanners report it against CVE-2026-2332 (CVSS 9.1) and a number of other Jetty CVEs fixed in 12.0.31 through 12.0.39, including CVE-2026-1605, CVE-2026-5795, CVE-2026-10050… --- ## [Node.js CVEs (CVE-2026-111497 and more): Not Applicable to Ignition](https://forum.inductiveautomation.com/t/node-js-cves-cve-2026-111497-and-more-not-applicable-to-ignition/117602)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:23pm UTC](https://forum.inductiveautomation.com/t/node-js-cves-cve-2026-111497-and-more-not-applicable-to-ignition/117602 "2026-10-25T15:23:21Z")
Ignition is not affected by the October 21, 2026 Node.js security release, which fixed ten vulnerabilities in Node.js 22, 24, and 26 (patched in 22.23.4, 24.22.1, 26.12.1): CVE-2026-111497 (Brotli decoder RCE, Critical,… --- ## [Ignition Software and Artificial Intelligence (AI)](https://forum.inductiveautomation.com/t/ignition-software-and-artificial-intelligence-ai/117601)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:17pm UTC](https://forum.inductiveautomation.com/t/ignition-software-and-artificial-intelligence-ai/117601 "2026-10-25T15:17:09Z")
Ignition and AI Ignition is a commercial off the shelf (COTS) software platform delivered under an on-premises shared responsibility model: Inductive Automation produces and supports the software; you install it, run it … --- ## [IA EU Cyber Resilience Act (CRA) commitment and Ignition](https://forum.inductiveautomation.com/t/ia-eu-cyber-resilience-act-cra-commitment-and-ignition/117600)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 3:11pm UTC](https://forum.inductiveautomation.com/t/ia-eu-cyber-resilience-act-cra-commitment-and-ignition/117600 "2026-10-25T15:11:10Z")
Inductive Automation is committed to Ignition 2027 being fully CRA conformant before the December 11, 2027 application date, with a CE mark and a publicly accessible EU declaration of conformity. Ignition is already deve… --- ## [Bouncy Castle 1.78.1 (CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, CVE-2026-5588): Update coming; Not Exploitable in Ignition](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 2:35pm UTC](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598 "2026-10-25T14:35:38Z")
Ignition is assessed as not impacted by current Bouncy Castle cryptographic library CVEs. Ignition 8.1.54 and 8.3.8 bundle Bouncy Castle 1.78.1, which falls in the affected range for these four CVEs (CVE-2025-14813, CVE-… --- ## [PHP2Shell (CVE-2026-109618, CVE-2026-109619): Not Applicable to Ignition](https://forum.inductiveautomation.com/t/php2shell-cve-2026-109618-cve-2026-109619-not-applicable-to-ignition/117597)
**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Replies:** 0\ **Last updated:** [October 25, 2026, 2:30pm UTC](https://forum.inductiveautomation.com/t/php2shell-cve-2026-109618-cve-2026-109619-not-applicable-to-ignition/117597 "2026-10-25T14:30:59Z")
Ignition is not affected by the “PHP2Shell” memory safety vulnerabilities in core PHP (CVE-2026-109618, CVE-2026-109619). Ignition is a Java application that ships its own JRE. No Inductive Automation component (Gateway…