# \#cve

**URL:** https://forum.inductiveautomation.com/tag/cve/88.md

[Latest](https://forum.inductiveautomation.com/latest.md) · [Categories](https://forum.inductiveautomation.com/categories.md) · [Tags](https://forum.inductiveautomation.com/tags.md)

---

## [Jetty CVEs in Ignition 8.1 (CVE-2026-2332 and others): Fix Targeted for 8.1.56; 8.3 not affected](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603)

<div class="topic-metadata">

**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\
**Replies:** 0\
**Last updated:** [October 25, 2026, 3:33pm UTC](https://forum.inductiveautomation.com/t/jetty-cves-in-ignition-8-1-cve-2026-2332-and-others-fix-targeted-for-8-1-56-8-3-not-affected/117603 "2026-10-25T15:33:27Z")

</div>

Ignition 8.1 bundles Jetty 12.0.27. Dependency scanners report it against CVE-2026-2332 (CVSS 9.1) and a number of other Jetty CVEs fixed in 12.0.31 through 12.0.39, including CVE-2026-1605, CVE-2026-5795, CVE-2026-10050…

---

## [Node.js CVEs (CVE-2026-111497 and more): Not Applicable to Ignition](https://forum.inductiveautomation.com/t/node-js-cves-cve-2026-111497-and-more-not-applicable-to-ignition/117602)

<div class="topic-metadata">

**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\
**Replies:** 0\
**Last updated:** [October 25, 2026, 3:23pm UTC](https://forum.inductiveautomation.com/t/node-js-cves-cve-2026-111497-and-more-not-applicable-to-ignition/117602 "2026-10-25T15:23:21Z")

</div>

Ignition is not affected by the October 21, 2026 Node.js security release, which fixed ten vulnerabilities in Node.js 22, 24, and 26 (patched in 22.23.4, 24.22.1, 26.12.1): CVE-2026-111497 (Brotli decoder RCE, Critical,…

---

## [Bouncy Castle 1.78.1 (CVE-2025-14813, CVE-2025-8916, CVE-2026-0636, CVE-2026-5588): Update coming; Not Exploitable in Ignition](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598)

<div class="topic-metadata">

**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\
**Replies:** 0\
**Last updated:** [October 25, 2026, 2:35pm UTC](https://forum.inductiveautomation.com/t/bouncy-castle-1-78-1-cve-2025-14813-cve-2025-8916-cve-2026-0636-cve-2026-5588-update-coming-not-exploitable-in-ignition/117598 "2026-10-25T14:35:38Z")

</div>

Ignition is assessed as not impacted by current Bouncy Castle cryptographic library CVEs. Ignition 8.1.54 and 8.3.8 bundle Bouncy Castle 1.78.1, which falls in the affected range for these four CVEs (CVE-2025-14813, CVE-…

---

## [PHP2Shell (CVE-2026-109618, CVE-2026-109619): Not Applicable to Ignition](https://forum.inductiveautomation.com/t/php2shell-cve-2026-109618-cve-2026-109619-not-applicable-to-ignition/117597)

<div class="topic-metadata">

**Author:** [@nathan.boeger](https://forum.inductiveautomation.com/u/nathan.boeger)\
**Replies:** 0\
**Last updated:** [October 25, 2026, 2:30pm UTC](https://forum.inductiveautomation.com/t/php2shell-cve-2026-109618-cve-2026-109619-not-applicable-to-ignition/117597 "2026-10-25T14:30:59Z")

</div>

Ignition is not affected by the “PHP2Shell” memory safety vulnerabilities in core PHP (CVE-2026-109618, CVE-2026-109619). Ignition is a Java application that ships its own JRE. No Inductive Automation component (Gateway…