Topic · cisa

CISA

CISA — Cybersecurity and Infrastructure Security Agency. Use for CISA-issued alerts, advisories, programs, and leadership statements. Children handle specific products (kev, circia, bod).

RSS feed ↗

regulator
CISA flags CVE-2026-15340 buffer overflow in lwIP SMTP client
Reachable over the network with no authentication, the overflow can enable remote code execution on unpatched 2.2.1 builds.
CISA published ICSA-26-279-02 for CVE-2026-15340, a buffer overflow in Savannah lwIP SMTP client 2.2.1 rated 9.8 critical. The attack vector is network-based with no authentication or user interaction, and success can crash the device or enable remote code execution. The advisory lists Energy and Water and Wastewater Systems as affected sectors, deployed worldwide. The fix ships as git commit 614420f82c8729d070e01464c0dddb3c9525c772 via patch_125_smtp_txbuf.diff, disclosed by xchglabs after the patch released.
TODAY
trade-press
Gold Eagle faces interoperability questions from Venable nonprofit
The paper says the clearinghouse launch language left open-source maintainers' role ambiguous, and proposes the government focus on coordination gaps only it can fill.
The Cybersecurity Coalition, part of Venable's Center for Cybersecurity Policy and Law, published a white paper Sept. 24 arguing the Gold Eagle AI cybersecurity clearinghouse needs defined interfaces with private-sector open-source vulnerability initiatives. The paper identifies three existing industry-led efforts (Akrites (Linux Foundation), Chainguard's Athena, and Lightwell (IBM/Red Hat)) and says Gold Eagle's July launch announcement "does not clearly articulate a role for open-source maintainers." Its recommendation: Treasury and CISA should focus on cross-sector deconfliction and escalations while routing open-source findings to the projects already built for maintainer coordination.
SAT
vendor
Governments drew 27% of Microsoft's observed 2026 threat activity
The 27% share is Microsoft-owned telemetry, not a census; the phishing jump to 23% is the operational signal for identity control owners.
Microsoft's 2026 Digital Defense Report puts government agencies and services at 27% of threat activity its telemetry observed between July 2025 and June 2026, up from 17% in 2025, and names the sector the top nation-state target. Dwell time rose across sectors, and phishing jumped to 23% of observed intrusions from 7%. Those figures are vendor telemetry, not an independent census, and the five government priorities are advocacy. The phishing swing is load-bearing: compromised identities as the entry point.
SAT
trade-press
National Cyber Director Urges CEOs to Track AI Agents in Supply Chains
The security problem has moved from the model to the agent, and most organizations have no inventory of either.
National Cyber Director Sean Cairncross said Tuesday that business leaders need visibility into AI agents running in their supply chains, who has authorization, what they can access, and where they're operating. Speaking at a USTelecom event, Cairncross also said the administration is working to deploy AI models across critical infrastructure sectors for cyber defense "as quickly as possible." The dual message (accelerate deployment while tracking agents) comes as the administration pushes rapid AI adoption in defense without new regulations.
SAT
trade-press
WaterISAC Pushes Faster Threat Sharing After Summer PLC Attacks
CISA, FBI, and EPA have pointed to Iranian-affiliated actors since April, but the structural problem remains unchanged: thousands of internet-exposed controllers, aging hardware, and integrator connections that small utilities don't know they have.
WaterISAC is adopting Cyware's threat intelligence platform to speed cross-sector threat sharing after a summer of attacks on internet-exposed PLCs at water utilities across at least 12 states. Executive Director Tom Dobbins told CyberScoop the sector's biggest vulnerabilities are exposed OT, aging PLCs built "pre-cyber threats," insecure integrator connections, and poor cyber hygiene at smaller utilities. CISA, FBI, and EPA have jointly attributed the PLC-targeting campaign to Iranian-affiliated actors since April, an assessment Dobbins endorsed over President Trump's public dismissal of Iranian involvement.
SAT
trade-press
Kiteworks tells customers to shut down Saturday over zero-day threat
Federal intelligence flagged a credible threat, but Kiteworks hasn't confirmed a CVE, a patch, or an attacker, leaving practitioners with a shutdown window and a lot of unanswered questions.
Kiteworks emailed customers this week recommending they shut down the company's managed file transfer platform during a six-hour window on Saturday. CISO Frank Balonis told Recorded Future News the company received "credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems." Balonis said the advisory is preventative ("we are not aware of any compromise") and that all known vulnerabilities are addressed in the current 9.5.1 release. A Kiteworks customer-support official separately told German outlet Heise the warning involved a potential zero-day, but the company declined to say whether a CVE had been assigned or which group was involved. Neither the FBI nor CISA commented.
SAT
regulator
Viidure Dashcam App Carries One 10.0, One High-Severity Bug
Hardcoded cloud-storage credentials earn CVSS 10; a second, public-read bucket flaw hits 8.7, and the vendor isn't responding.
CISA published ICSA-26-272-07 on two vulnerabilities in the Viidure Dashcam Android Application (versions ≤3.3.1.260403). CVE-2026-96587 embeds plaintext cloud-storage credentials in compiled application code, attackers extracting them gain full read, modify, and delete access to critical platform files including firmware and application binaries (CVSS v4 10). CVE-2026-94204 is a misconfigured cloud storage backend with public-read permissions, exposing user records, live footage, and platform files (CVSS v4 8.7). Viidure did not respond to CISA's coordination attempts. No fix is planned.
SAT
regulator
Meari OpenAPI flaws expose device credentials, no fix planned
Meari declined CISA coordination twice in a year, leaving operators to isolate platforms they can't patch.
CISA's ICSA-26-274-06 covers two missing-authorization flaws (CWE-862) in Meari's IoT Cloud Platform OpenAPI Service, all versions. An authenticated user can reconfigure devices they don't own (CVE-2026-101104, CVSS 7.7) or pull any device's full shadow, credentials and owner data included, just by supplying its ID (CVE-2026-96613). No fix is planned and Meari didn't answer CISA, so operators have to isolate rather than patch.
SAT
regulator
Toptech TMS7 hit by 10 CVEs, one a CVSS 10 unauthenticated database dump
The file-export flaw needs no credentials, no session, and no foothold, any attacker who can reach the server walks away with the database.
CISA issued an advisory covering 10 vulnerabilities in Toptech TMS7 and TopHAT 7.6.3, terminal-management software deployed across energy, chemical, and transportation infrastructure worldwide. CVE-2026-71379 scores 10.0: an unauthenticated attacker sends a crafted POST request and exports arbitrary database tables. Five additional flaws are SQL injection; another allows arbitrary PHP file upload. Toptech alerted customers on July 20, 2026 and says release 7.8 addresses all ten.
SAT
regulator
CISA flags RCE, auth bypass flaws in its own Malcolm tool
The audit tool CISA hands to critical infrastructure operators carries a high-severity OS command injection flaw and an authentication bypass that routes around its own role controls.
CISA's ICSA-26-254-01 discloses a dozen-plus vulnerability classes in Malcolm, the agency's free network traffic and log analysis suite, affecting all versions before v26.06.0. The worst is CVE-2026-90444, an 8.8 CVSS OS command injection: an authenticated user uploads a file whose name carries shell metacharacters, and a later automated process runs it with the privileges of that process. CVE-2026-90447 lets anyone holding a shared service credential set a request header to swap in the elevated fixed role. Fix is to v26.06.0 or later.
SAT
regulator
MikroTik RouterOS pre-auth RCE is a 9.8
Integer underflow in the HTTP handler is reachable without authentication and needs only a single crafted request, a rare attack surface for router firmware that puts this in the top remediation tier.
CISA issued ICSA-26-272-06 for CVE-2026-84411, a CVSS 9.8 unauthenticated remote code execution flaw in the web management service of MikroTik RouterOS versions below 7.24. An attacker can achieve root-level code execution or denial of service with one crafted HTTP request, no authentication, no user interaction. MikroTik directs users to upgrade to version 7.23 or later. CISA states no known public exploitation has been reported to it at this time.
SAT
regulator
CISA Flags Baicells Nova 430H DoS Bug, No Vendor Fix Planned
A malformed NAS payload over the air can knock a cell offline, and Baicells hasn't responded to CISA's coordination requests, leaving operators with nothing but network hardening.
CISA disclosed CVE-2026-96274, a CVSS 7.4 unauthenticated denial-of-service vulnerability in Baicells Nova 430H eNodeB (model pBS3101SH) running firmware through BaiBLQ_3.0.12. An attacker within radio range can send a malformed NAS payload during connection setup that the eNodeB forwards to the core network, triggering a shutdown of the cell's signaling association. Baicells hasn't responded to CISA's vendor coordination outreach and no fix is planned. The equipment is deployed worldwide in the Communications and IT sectors.
SAT
regulator
Anjvision YSSD-RTMP-H5 Hit With Nine CVEs, No Fix Coming
The advisory covers vulnerabilities up to 9.8 CVSS on firmware 3.3.2.4, and the vendor hasn't responded to CISA's coordination requests, so operators can't count on a patch.
CISA published ICS advisory ICSA-26-272-05 covering nine vulnerabilities in Anjvision YSSD-RTMP-H5 streaming devices running firmware 3.3.2.4. The CVEs range from unauthenticated ONVIF bypass and OS command injection to hard-coded cloud credentials, unsigned firmware updates, and an admin-password-reset via empty POST. The highest scores hit 9.8. Anjvision, headquartered in China, has not responded to CISA's coordination attempts and no fix is planned. The affected devices are deployed worldwide in the Commercial Facilities sector. Operators who can't reach the vendor for mitigations are left with the familiar grim calculus: isolate the device or accept the risk.
SAT
regulator
CISA Adds Fortinet FortiMail Path-Traversal CVE to KEV Catalog
The binding remediation requirement stops at FCEB agencies; everyone else gets CISA's encouragement, not a mandate.
CISA added CVE-2026-104286, a Fortinet FortiMail path-traversal vulnerability, to the Known Exploited Vulnerabilities Catalog after evidence of active exploitation. Under BOD 26-04, the listing brings rapid-remediation prioritization for FCEB agencies when the asset is publicly exposed and grants total control after exploitation, with lower-risk work deferred. The directive binds only FCEB agencies; for contractors it's CISA's encouragement, not a requirement.
SAT
trade-press
CISA ties AI-scale vuln discovery to CVE program overhaul
Gold Eagle clearinghouse can ingest hundreds of AI-generated reports, but without new deduplication and data standards the CVE pipeline can't absorb them, and CISA is building both tracks simultaneously.
CISA acting cyber chief Chris Butera laid out a two-track vulnerability management overhaul at a Federal News Network event: Gold Eagle, the Treasury-led AI clearinghouse that ingests and deduplicates AI-discovered vulnerability reports at scale, and concurrent reforms to CVE program governance, data standards, and infrastructure. Butera framed them as connected, the CVE pipeline can't handle the volume AI models are now producing without machine-readable submission formats, deduplication, and a new prioritization mechanism to protect under-resourced open-source maintainers from alert floods.
SAT
trade-press
CISA 2015 reauthorization hangs on lame-duck session
USTelecom is now tying the threat-sharing law's fate to AI-driven exploitation, the first time machine-speed vulnerability discovery has been used to frame the urgency calculus for Congress.
The Cybersecurity Information Sharing Act of 2015, which provides liability and antitrust protections for industry threat-sharing with DHS and among peers, runs through Dec. 11 on its third short-term extension. The House passed a reauthorization through 2035 as part of the fiscal 2027 NDAA; the Senate has a competing 2036 endpoint via Homeland Security ranking member Gary Peters (D-MI). USTelecom's Robert Mayer and Brandon Heiner are pressing for the long-term fix, explicitly linking reauthorization to AI-enabled attacks that probe critical infrastructure at speed, a framing shift from the nation-state and ransomware threats that dominated earlier renewal arguments.
SAT
trade-press
CISA, partners reject copy-paste zero trust for OT
The April joint guide is the first federal break from copy-paste IT controls, but it leaves compliance deadlines and auditing unspecified.
In April, CISA and four federal partners released Adapting Zero Trust Principles to Operational Technology, the first interagency zero-trust guide that treats OT as distinct from IT rather than an extension of the enterprise playbook. It puts asset visibility and network segmentation ahead of direct IT control translation, with secure communications and stronger identity controls in support. What's absent is any compliance deadline or audit mechanism, let alone an acquisition rule tying contractors to the standard.
SAT
trade-press
GAO third panel finds CIRCIA and SEC rules conflict with sector regs
After two rounds of industry feedback, the picture isn't improving: energy, financial, and healthcare participants say reporting thresholds, timelines, and definitions across federal rules can't all be met.
GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrecy Act, and others. Participants from energy, financial services, and healthcare and public health each described reporting thresholds, timelines, and definitions that diverge across the rules they're subject to. Most participants said federal harmonization progress over the past year has been limited. The panel floated establishing a single entity with authority over regulatory consistency.
SAT
regulator
CISA Adds Two Critical NetScaler Zero-Days to KEV Catalog
The KEV listing means active exploitation is confirmed, and organizations that patch before checking for compromise risk losing forensic evidence of an intrusion already in progress.
CISA added CVE-2026-88771 and CVE-2026-88772 (two critical remote-code-execution vulnerabilities in Citrix NetScaler ADC and Gateway) to its Known Exploited Vulnerabilities catalog. Both are zero-days; CISA has received reports and partner threat intelligence confirming threat actors are actively exploiting them globally. The alert covers eight total CVEs in the same product line. Citrix has published indicators of compromise and guidance for assessing potential compromise before applying updates, since patching may destroy forensic evidence.
SAT
regulator
CISA Adds WordPress RFI Bug to KEV Catalog
A remote file inclusion vulnerability in WordPress Core is now a BOD 26-04 priority for every federal agency running a public-facing instance.
CISA added CVE-2026-87902, a WordPress Core Remote File Inclusion vulnerability, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies must prioritize remediation on publicly exposed assets under BOD 26-04. The directive also requires agencies to determine whether threat actors compromised systems before the patch was applied. CISA encourages all organizations (not just FCEB) to adopt the KEV catalog as a prioritization input.
SAT
trade-press
CI Fortify pushes OT isolation without the Monday playbook
Four allied agencies now agree critical infrastructure operators must be able to isolate operational technology during a crisis, but nobody's said how to sync data across the boundary in peacetime without breaking the isolation.
CISA, ASD, CCCS, and NCSC released joint guidance July 28 under the CI Fortify banner urging critical infrastructure operators to develop the capability to physically and digitally isolate operational technology from business networks and third-party systems. The guidance frames isolation as emergency planning, something operators should rehearse so essential services can continue during a geopolitical conflict when telecommunications and internet may be unreliable. It does not specify implementation timelines, compliance verification mechanisms, or how operators should manage routine data synchronization across isolated boundaries without creating the kind of workarounds that isolation is meant to prevent.
SAT
trade-press
86% of agencies missed SCuBA cloud deadline, IG finds
The compliance gap isn't about the quality of the baselines, it's that CISA has no authority to make anyone follow them, and the DHS IG just put that in writing.
A DHS Inspector General audit found that 86% of federal civilian agencies failed to implement all mandatory SCuBA cloud security baselines by the June 2025 deadline. The IG also concluded that CISA "lacks the authority necessary to require full and timely implementation of Binding Operational Directives", a finding that echoes GAO's 2020 assessment and that the IG explicitly cited as the reason it issued no recommendations to the agency. CISA didn't comment.
SAT
trade-press
CISA pledges election coordination after cuts hollowed out state ties
The 2026 election security plan names regional directors as advisers and touts a threat-sharing platform, but doesn't restore dedicated election adviser positions or identify funding, while the agency's own FY27 budget proposal zeroes out the election security program.
CISA released its 2026 Election Infrastructure Security Plan Thursday, naming its 10 regional directors as election security advisers and describing a free threat-sharing platform connecting election officials, state fusion centers, and federal partners. The document follows months of staffing and program reductions that Michigan Deputy Secretary of State Aghogho Edevbie told lawmakers had destroyed working relationships with CISA personnel. The plan doesn't announce restoration of dedicated election adviser roles or specify funding. The Trump administration's FY27 budget proposal would eliminate CISA's election security program entirely, a shift that still requires congressional approval.
SEP 24
regulator
Botslab G980H Dashcams Hit by 13 High-Severity Flaws
CISA published the advisory after the Chinese vendor went silent on mitigation requests, leaving transportation operators to self-defend.
CISA published an advisory for 13 vulnerabilities in Botslab G980H dashcams, CVSS scores reaching 8.8, affecting firmware versions deployed in transportation critical infrastructure worldwide. The flaws span session hijacking, authentication bypass via replay, predictable session identifiers, weak default WiFi passwords, hard-coded credentials, and a root shell accessible over UART without a password. Botslab hasn't responded to CISA's requests to coordinate mitigation. No vendor fix is currently available. Organizations with these units in fleet or municipal deployments should assume the devices are reachable on-adjacent-network and limit exposure accordingly.
SEP 24
regulator
CISA flags command injection, hardcoded creds in Eufy Omni C20, X10 Pro
Three CVEs disclosed for a Chinese-manufactured camera line as federal supply-chain scrutiny of networked devices intensifies, no word on patch timeline or government deployment.
CISA published three vulnerabilities in Eufy Omni C20 and Omni X10 Pro devices running firmware below 1.6.4. CVE-2026-93289 is an unauthenticated command injection during pairing affecting both models. CVE-2026-93290 (hardcoded credentials exposing mapping data) and CVE-2026-93291 (certificate validation failure enabling man-in-the-middle arbitrary code execution, CVSS 3.1 score 9.4) affect the Omni C20 only. Eufy recommends upgrading to 1.6.4. CISA reports no known public exploitation. The advisory lands against a backdrop of heightened federal supply-chain scrutiny on networked devices from China-based manufacturers.
SEP 24
trade-press
CISA maps CVE program's Quality Era in new white paper
The framework names four dimensions of quality, but the most persistent complaint (missing machine-readable software identifiers in CVE records) didn't make the page.
CISA released a white paper Wednesday outlining how it plans to move the Common Vulnerabilities and Exposures program from a "Growth Era" into a "Quality Era." The paper (which follows a September 2025 strategy document) defines quality across four dimensions: program governance, ecosystem participation, data infrastructure, and CVE record content. Over 67,000 CVEs have been published so far in 2026, and NIST's National Vulnerability Database has seen a 263% increase in submissions since 2020. CISA is soliciting community feedback on the framework.
SEP 23
trade-press
Democrats seek CISA force-structure assessment as headcount hits 2,400
The bill revives a Solarium Commission requirement last run in 2021, this time against the backdrop of a nearly 30% staffing drop since January 2025.
Rep. James Walkinshaw (D-VA) introduced the CISA Force Structure Assessment Act on Sept. 21, co-sponsored by Homeland Security ranking member Bennie Thompson (D-MS) and cyber subcommittee Chairwoman Delia Ramirez (D-IL). The bill requires the CISA Director to report on the workforce and resources needed to carry out the agency's full mission, securing federal systems, supporting critical infrastructure, threat hunting, and engaging international partners. It builds on a similar requirement in the fiscal 2021 NDAA, which the Cyberspace Solarium Commission championed. The legislation arrives as a January data release from CISA showed headcount dropping from 3,387 to 2,389 employees during the first year of the second Trump administration.
SEP 23
trade-press
State-local cyber grant faces Sept. 30 lapse with no Senate path
The House passed reauthorization. The continuing resolution skipped it. Now the Senate has three weeks and no visible markup.
The State and Local Cybersecurity Grant Program's authorization expires Sept. 30, and the recent continuing resolution that extended CISA 2015 left it out. House Homeland Security Chairman Andrew Garbarino (R-NY) is pressing the Senate to take up the PILLAR Act, which the House passed in November. CISA and FEMA can still administer remaining FY2025 funds, $103.8 million announced in August, but a GOP committee aide told Inside Cybersecurity that reauthorization is "the only way to ensure stability." The Senate Homeland Security Committee has not indicated whether it will take up either the House bill or Sen. Maggie Hassan's narrower extension before the deadline.
SEP 23
trade-press
IG finds 86% of agencies missed CISA's cloud security deadline
The DHS IG confirms what practitioners have known: BOD deadlines land with a thud when CISA has no enforcement authority beyond monitoring and reporting.
The DHS Inspector General found that 88 of 102 federal civilian agencies failed to meet the June 2025 deadline for CISA's Binding Operational Directive 25-01, which requires cloud environments to align with SCuBA secure configuration baselines. As of February 2025, 76% remained non-compliant, with gaps in MFA enforcement, legacy authentication blocking, and PII protection remaining open. The IG concluded CISA lacks authority to compel implementation, leaving the federal cloud security posture weakened and agencies exposed to preventable threats.
SEP 23
regulator
FBI, CISA Tie ICS Integrator Guidance to Live Intrusion
The advisory is the first joint FBI-CISA product explicitly linking a third-party integrator compromise to exfiltration of customer SCADA schematics, and it puts the hardening burden on the operator, not the integrator.
FBI and CISA published joint guidance Thursday urging critical infrastructure operators to enforce least-privilege access for third-party ICS integrators. The advisory anchors its recommendations in a March-April 2025 intrusion at a U.S. industrial automation vendor (one that served power utilities and transportation entities) where threat actors searched for "SCADA" and "customers" and created nine .zip files of roughly 800 files for presumed exfiltration. The guidance stops short of mandating contractual audit requirements or setting a compliance deadline; it's advisory, not a binding operational directive.
SEP 23
trade-press
CISA to publish CI Fortify lessons learned from Five Eyes assessments
The agency is collecting field data on whether operators can actually isolate and recover OT systems under duress, and plans to turn that into practical guidance, not just another framework document.
CISA is conducting assessments of critical infrastructure operators' ability to isolate and recover OT systems during a cyber incident, and will publish the resulting lessons learned alongside isolation and recovery guidance co-developed with Five Eyes partners. The initiative, CI Fortify, launched in May 2025 and has already produced joint guidance on OT isolation led by the Australian Signals Directorate in July. ICS lead Matt Rogers told a Sept. 21 webinar that operators need to test their plans: "If you haven't tested it, you don't really know if it's going to work."
SEP 22
trade-press
FAA can't detect spectrum attacks on aircraft comms in real time, GAO finds
The agency identified spoofing and jamming threats to the National Airspace System internally but hasn't completed risk assessments, updated security documentation, or deployed real-time monitoring.
A GAO report released September 21 finds FAA has not completed risk and mitigation assessments or deployed real-time monitoring for spectrum threats (spoofing, jamming, and interference) to the National Airspace System, despite having internally identified those threats. Two major pilot-controller text communications networks, CPDLC and ACARS, lack authentication and encryption, leaving them vulnerable to interception and spoofing. FAA acknowledged the risks but cannot currently detect spectrum attacks as they occur, forcing it to investigate only after incidents are reported.
SEP 22
trade-press
Gottheimer bill would fund $100M CISA AI pilot for critical infrastructure
The proposal arrives as ONCD's Texas Watershed 250 pilot runs without dedicated federal funding, and as the Trump administration's AI executive order left critical-infrastructure testing largely voluntary.
Rep. Josh Gottheimer (D-N.J.) introduced the AI Cyber Defense Act, which would authorize $100 million over fiscal years 2027, 2031 for a CISA-run pilot giving critical infrastructure operators free access to frontier AI models for vulnerability detection and remediation. The bill would prioritize nonprofit, publicly owned, rural, and small organizations. Gottheimer cited the recent wave of cyberattacks on water facilities as the impetus. Unlike the ONCD-led Watershed 250 pilot in Texas, which relies on voluntary private-sector contributions, the legislation puts a dollar figure on the table, though appropriators haven't followed through yet, and CISA has faced funding cuts under the Trump administration.
SEP 22
regulator
Siemens fleet management tools hit by unauthenticated file-read flaw
CVE-2026-67367 lets unauthenticated attackers read arbitrary files from the underlying OS (credential stores, private keys, configuration secrets) without any credentials.
Siemens released patches for a path traversal vulnerability (CVE-2026-67367, CVSS 8.6) in SIMOVE Fleetmanager and SIPLANT that allows unauthenticated remote attackers to read arbitrary files from the embedded HTTP server's host operating system. Affected versions span SIMOVE Fleetmanager V3.1 through V4.0 and SIPLANT V1.7 through V3.1. Fleetmanager fixes are available through Siemens' support portal. For SIPLANT V1.7 and V2.2 (all versions affected) Siemens directs users to contact customer support rather than pointing to a published patch. SIPLANT V3.0 is also affected across all versions with no patch version specified.
SEP 22
regulator
CISA flags lwIP double-free vulnerability hitting critical infrastructure
The advisory arrives a day after CISA's prior lwIP notice, this one CVSS 8.8, adjacent-network exploitable, no public exploit confirmed yet.
CISA disclosed CVE-2026-91018, a double-free vulnerability in lwIP versions 2.0.1 through 2.2.1, with a CVSS 3.1 score of 8.8. The advisory lists affected critical infrastructure sectors: chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater systems. A patch is available via commit f873b6295933e4149a2132adf3e9a2d2a676a5ec. Eric Evenchick of Tetrel Security reported the vulnerability. CISA states no known public exploitation targeting this vulnerability has been reported at this time.
SEP 22
regulator
OpenPLC v3 XSS Lets Attackers Seize Control of ICS
End-of-life software running critical infrastructure leaves operators with two choices: upgrade to v4 or isolate the box from anything that runs a browser.
CISA disclosed CVE-2026-88020, a cross-site scripting vulnerability in OpenPLC Runtime v3 that lets unauthenticated remote attackers steal session cookies and issue operator commands controlling physical processes. OpenPLC v3 is end-of-life, no patches, no bug fixes, no security updates. The vendor and CISA both point to upgrading to v4 as the remedy. Sectors affected: critical manufacturing, energy, water, and transportation. This is the fourth CISA advisory on OpenPLC v3 since September 2025.
SEP 22
regulator
Siemens WTV676 and WTV776 web interfaces need patching for DoS bug
An unauthenticated remote attacker can force these building-automation devices into protection mode, killing remote web access until someone physically intervenes.
CISA published ICSA-26-265-08 for CVE-2026-89207, a denial-of-service vulnerability in Siemens WTV676 and WTV776 web interfaces. An unauthenticated remote attacker can force affected devices into protection mode, which disables remote connectivity. WTV676 versions below 3.94 and WTV776 versions below 4.17 are affected. Siemens has released firmware updates and points operators to SSA-823812 for mitigation details. CISA's advisory rates the CVSS at 6.5 (medium) and flags the energy sector as the critical-infrastructure concern.
SEP 22
regulator
lwIP MQTT client gets CISA advisory, CVSS 9.8
The vulnerable MQTT client ships in millions of embedded devices across critical infrastructure, and there's no firmware yet, just a source commit.
CISA published an ICS advisory for an out-of-bounds write (CVE-2026-87121, CVSS 9.8) in the lwIP TCP/IP Stack MQTT Client Application, versions 2.0.1 through 2.2.1. Successful exploitation allows remote code execution on affected devices. The advisory lists deployment across eight critical infrastructure sectors (chemical, communications, critical manufacturing, energy, financial services, healthcare and public health, transportation systems, and water and wastewater) worldwide. The fix is a single commit in the lwIP repository. Device vendors haven't shipped integrated firmware updates yet.
SEP 22
trade-press
Cyber Storm X simulated nation-state attack on water and transportation
CISA's tenth biennial exercise drew 2,000 participants; the after-action report won't land for months, but two sectors got a rare chance to rehearse a multi-front coordinated incident.
CISA concluded Cyber Storm X on September 18, simulating a nation-state adversary attacking the transportation and water and wastewater sectors simultaneously. The exercise involved 2,000 participants from federal agencies, state and local governments, international partners, and private-sector critical infrastructure operators. COO Ryan Donaghy told Inside Cybersecurity that high-level takeaways include the importance of a whole-of-government approach and the private sector's continued reliance on federal guidance during significant incidents. A full after-action report will follow, CISA's Cyber Storm IX after-action landed about five months after that exercise concluded.
SEP 18
trade-press
NIST to Open-Source Its NVD AI Enrichment Workflow
The GitHub release marks a quiet admission that NIST can't enrich every CVE alone, and the tooling belongs in the ecosystem's hands.
NIST detailed its V-etalon agentic AI workflow at a Sept. 17 webinar and said the tool will hit GitHub "very soon" as an open-source project. The AI proposes enrichment data for National Vulnerability Database records using evidence traced to public sources like vendor advisories, with decisions mapped to specific passages. NIST won't auto-publish AI-generated enrichment until statistical models justify it. The bigger move: NIST wants the vulnerability management ecosystem to adopt and extend the tooling, not just consume NVD output. The related RFI on modernizing the NVD closes October 13.
SEP 18
trade-press
NIST drafts first CSF 2.0 profile for federal Open RAN
The profile operationalizes CSF 2.0's supply-chain risk management language against an architecture deliberately designed to multiply vendors rather than consolidate them.
NIST released draft IR 8623, a CSF 2.0 community profile for federal agencies deploying Open Radio Access Network infrastructure. The profile maps disaggregated RAN components to CSF 2.0 outcomes and references O-RAN Alliance security specifications. It adds new columns for O-RAN risk scores and technical reports, a structural departure from earlier CSF community profiles. Comments close November 2. It's the first profile built for an architecture whose defining feature is multiplying vendors, making it an operational test of the supply-chain risk management language CSF 2.0 added in its Govern function.
SEP 18
trade-press
Stop Rogue AI Act Would Make NIST Agent Guidance a Procurement Mandate
This bipartisan bill would turn NIST's ongoing AI agent security work into mandatory FAR requirements, marking the first legislative push to route AI governance through federal procurement rules.
The bipartisan Stop Rogue AI Act directs NIST to develop standards for discovering, verifying, and controlling AI agents, continuous inventory, verifiable provenance, real-time monitoring for prompt injection and data theft, and human-overridable access controls. The FAR Council must then impose those standards on contractors and agencies procuring or deploying AI agents or systems that interact with them. NIST is already doing this work through CAISI's Agent Standards Initiative and an RFI that closed earlier this year. The bill's real move is converting voluntary guidance into procurement mandates. Timeline and retroactivity are unspecified.
SEP 18
regulator
CISA Adds Two Linux Kernel CVEs to KEV Catalog
A kernel race condition and an out-of-bounds write, both under active exploitation, now carry BOD 26-04 remediation deadlines for federal agencies.
CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog on September 18, citing confirmed active exploitation. CVE-2025-39964 is a race condition; CVE-2026-53266 is an out-of-bounds write. Under Binding Operational Directive 26-04, federal civilian agencies must prioritize patching these on internet-facing assets. CISA didn't disclose the exploitation timeline or the actors involved, and offered no information on whether the attacks tie to known intrusions.
SEP 18
regulator
Bransys ELD Ships With Hardcoded MQTT and FTP Credentials
Hardcoded credentials in a shipping production app, not a novel threat pattern, just the standard operational-security failure that keeps showing up in transportation telematics.
CISA disclosed three vulnerabilities in the Bransys ELD transportation app affecting Android versions below 11.00.00 and iOS below 1.1.54. The flaws include hardcoded MQTT credentials granting read access to real-time data for every active device across a subset of carriers connected to the affected broker (CVE-2026-86520), cleartext transmission of sensitive information (CVE-2026-86689), and hardcoded FTP credentials (CVE-2026-77960). Bransys recommends updating through the app store. No known public exploitation has been reported to CISA. This is at least the second CISA ELD advisory involving default or hardcoded credentials since April 2024.
SEP 17
trade-press
CISA, Allies Catalog 17 Active Directory Attack Techniques
The updated multinational guidance signals that threat actors have converged on a common AD playbook, and the detection gaps being patched are ones Microsoft hasn't closed in the shipping product.
CISA and agencies from Australia, the UK, Canada, New Zealand, and the NSA updated joint guidance on detecting and mitigating Active Directory compromises, identifying 17 common threat techniques. The September 15 update expands the "Detecting DCSync" and "Shadow Credentials" sections with new detection and mitigation methods. The guidance targets permissive default settings, legacy protocol support, and diagnostic tooling gaps that make AD a high-value target. Identity administrators, security operations teams, and incident responders are urged to fold the recommendations into their defensive programs.
SEP 16
trade-press
NIST and CISA finalize token-fraud guidance for federal agencies
A mandate first written under Biden and preserved in Trump's 2025 cyber executive order produced a final interagency report that 250 public comments and a year of industry consultation shaped, rare continuity on identity-layer defense.
NIST and CISA released the final version of NIST IR 8587 on September 15, 2026, giving federal agencies and cloud service providers implementation guidance on protecting identity tokens and assertions from forgery, theft, and misuse. The publication expands on NIST SP 800-53 controls and incorporates nearly 250 public comments on token validation, secrets management, and detection. New in the final version: outcome-based cryptographic key guidance, high-level considerations for AI and post-quantum cryptography migration, and expanded options for token revocation and signal-sharing.
SEP 16
regulator
CISA Publishes Cyber Decoy Guidance for Post-Compromise Detection
Zero Trust architectures move the threat model inside the perimeter, and CISA's answer is decoys, not because they're clever, but because signature-based detection stops working when adversaries use legitimate credentials.
CISA released formal guidance on planning and implementing cyber decoy strategies (tripwires, breadcrumbs, honeytokens) mapped to the MITRE Engage and MITRE ATT&CK frameworks. The guidance is aimed at organizations that struggle to detect adversaries using legitimate credentials, native tools, and living-off-the-land techniques. It frames decoys as a complement to Zero Trust architectures, generating high-fidelity alerts that don't depend on anomaly baselines. The guidance does not specify staffing, infrastructure, or cost requirements for standing up and maintaining decoy operations across maturity levels.
SEP 16
trade-press
FBI launches Secure 2027 to counter PRC pre-positioning
The clock on Taiwan is the organizing principle, not a generic counter-espionage posture, but a specific bet that 2027 is when pre-positioned access becomes destructive action.
FBI Cyber Division chief Brett Leatherman announced "Secure 2027" at the Billington Cybersecurity Summit, the bureau's first unclassified cyber strategy, built around four pillars: investigate and impose cost, support victims, expand partnerships, and strengthen FBI cyber capabilities. The initiative is a coordinated effort with DoD and critical infrastructure operators, framed explicitly around Chinese pre-positioning in U.S. critical infrastructure ahead of a potential Taiwan conflict. Leatherman said the Salt Typhoon unified coordination group (co-led with CISA and the CIA) remains active because PRC targeting continues with 2027 readiness as the stated intent.
SEP 15
trade-press
BSA backs CISA reauthorization in House NDAA, flags three amendments
The software trade group's letter supports NIST-aligned vulnerability disclosure rules and a FedRAMP reciprocity pilot, while opposing provisions it says could sweep in routine commercial practices.
BSA (The Business Software Alliance) released an August 27 letter to Armed Services and party leaders backing CISA 2015's nine-year reauthorization through fiscal 2035, along with House NDAA provisions on FedRAMP reciprocity, vulnerability disclosure aligned to NIST guidelines, and post-quantum cryptography mandates. The letter also flags three House amendments it opposes or finds problematic: one on software-based cryptographic protections that BSA says conflicts with commercial cloud key-management architectures, one barring DoD contracts with providers that give advance vulnerability disclosure to countries-of-concern entities, and a third adding a 72-hour reporting deadline for discovering Chinese-linked hardware in contractor networks.
SEP 15
trade-press
CISA CDM program chases speed with automation, agile buying
The roadmap is sound, but the program couldn't locate all F5 instances during last October's emergency directive, the gap between "tool of first response" and current reality remains wide.
CISA deputy program manager Richard Grabowski laid out a three-pillar CDM roadmap Tuesday: velocity through automation, data unification, and data-driven risk management, positioning the program as "the tool of first response when the things hit the fan." Acting federal CISO Mike Duffy called for acquisition reform: agencies should aggregate demand and buy outcomes rather than products, with contracts designed for continuous improvement rather than decade-long lock-in. SIEM-as-a-Service gets its own three-year expansion plan. The roadmap is coherent. But the program's October 2025 inability to locate all F5 instances during an emergency directive (and a GAO finding that CDM only partially meets its goals) shows how far it still has to travel.
SEP 15