# Jetty CVEs in Ignition 8.1 (CVE-2026-2332 and others): Fix Targeted for 8.1.56; 8.3 not affected **URL:** \ **Category:** Security Notices\ **Tags:** cve, 8.1-update-pending\ **Created:** [October 25, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603 "2026-10-25T15:33:27Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![nathan.boeger](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/nathan.boeger/32/87646_2.png) [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\ **Post date:** [October 25, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603/1 "2026-10-25T15:33:27Z")
Ignition 8.1 bundles Jetty 12.0.27. Dependency scanners report it against CVE-2026-2332 (CVSS 9.1) and a number of other Jetty CVEs fixed in 12.0.31 through 12.0.39, including CVE-2026-1605, CVE-2026-5795, CVE-2026-10050, CVE-2026-18659, CVE-2026-18660, CVE-2026-18661, CVE-2026-18662, and CVE-2026-19864. Inductive Automation has reviewed these against Ignition 8.1. CVE-2026-2332 applies to the Gateway’s HTTP listeners and is treated as a valid finding. Most of the remaining CVEs depend on Jetty features the Gateway does not use (Digest authentication, JASPI, ProxyServlet, GzipHandler, servlet security constraints beyond the defaults) and are low impact for Ignition. All will be resolved by the same update. Inductive Automation is updating Jetty to 12.0.39 or later in Ignition 8.1.56. Until then, follow the Ignition Security Hardening Guide: network segmentation and a reverse proxy or load balancer in front of the Gateway reduce exposure. No exploitation against Ignition has been demonstrated. This post will be updated when 8.1.56 ships.