The CIP Briefing

No new water-sector-specific advisories were published by CISA or EPA in the past 7 days, and this week's routine CISA ICS advisories did not target core water treatment equipment. That's the good news. The bad news: CISA added ten new CVEs to the Known Exploited Vulnerabilities catalog between October 26 and October 30, and the most dangerous entries — a pair of Ivanti Connect Secure flaws and a Cisco ASA/FTD vulnerability — hit the exact type of remote access and firewall equipment that small utilities use every day to give integrators and staff VPN access to the plant network. If your integrator connects to your SCADA environment through an unpatched Ivanti VPN appliance, attackers are now chaining these two newly listed flaws with the October 13 Ivanti authentication bypass to walk past the login screen without credentials, seize full root control of the appliance, and harvest Active Directory passwords and recovery keys. Separately, if you run a Cisco ASA or FTD firewall with Remote Access SSL VPN enabled, an unauthenticated attacker can send a crafted login request that forces the firewall into a continuous crash and reload loop — dropping all VPN tunnels, severing remote SCADA telemetry, and blinding your operators at the main office until someone physically drives to your remote sites. Both sets of vulnerabilities are confirmed under active exploitation right now. On the compliance calendar: the December 31, 2026 deadline for updated Emergency Response Plans for utilities serving 3,301–49,999 people under AWIA is now fewer than 9 weeks out. Every week that passes without your ERP update in progress is a week you can't get back. Assign it this week.

🟠 [CRITICAL VULNERABILITY] Ivanti Connect Secure — Exploit Chain Vulnerabilities Added to KEV (CVE-2026-118527 & CVE-2026-111357)

On October 30, 2026, CISA added two Ivanti Connect Secure vulnerabilities to the Known Exploited Vulnerabilities catalog — both confirmed under active exploitation. CVE-2026-118527 is a predictable identifier vulnerability that allows an authenticated user to upload malicious files to a known path on the appliance, and CVE-2026-111357 is a privilege escalation flaw in the appliance's internal broker service that allows an attacker to elevate privileges to full root control. In the water sector, Ivanti Connect Secure (formerly Pulse Secure) is widely used to provide remote VPN access for SCADA integrators, remote operators, and IT contractors who manage OT equipment off-site. In active attacks tracked by CISA and threat researchers, adversaries are chaining these two flaws directly behind CVE-2026-104935 (the unauthenticated Ivanti authentication bypass covered in Vol. 1, Issue 30). Used together, this three-bug chain allows an unauthenticated attacker on the internet to bypass login entirely, plant malicious payloads, execute commands as root in memory, and silently harvest administrator passwords, Active Directory metadata, and BitLocker recovery keys. For a utility relying on an Ivanti VPN appliance as the remote bridge to the plant, an unpatched device gives an adversary the keys to both your business network and your control system.

Source: NVD CVE-2026-118527 | NVD CVE-2026-111357

🟠 [CRITICAL VULNERABILITY] Cisco ASA and FTD Software — SSL VPN NULL Pointer Dereference Vulnerability Added to KEV (CVE-2026-76418)

On October 29, 2026, CISA added CVE-2026-76418 to the KEV catalog. This is an unchecked return value to NULL pointer dereference vulnerability in the Remote Access SSL VPN (WebVPN) service on Cisco Secure Firewall ASA Software and Cisco Secure FTD Software when secondary authentication is configured on a tunnel group. Cisco ASA and FTD firewalls are among the most common perimeter devices at small and mid-size water utilities — often serving as the primary VPN concentrator and boundary firewall between the business/IT network and the OT/SCADA environment. A remote, unauthenticated attacker can send a crafted request to the SSL VPN login portal to trigger a crash and force the entire appliance to reload. Because a Cisco firewall fails closed while rebooting — and repeated requests can keep the appliance or a High Availability failover pair in a continuous reload loop — exploitation drops all active VPN tunnels and cuts off cross-boundary telemetry. In a utility environment, this severs remote SCADA visibility into well sites and booster stations, forcing operators to drive to remote facilities for routine checks while attackers use the outage to mask follow-on intrusion activity. This vulnerability is confirmed under active exploitation.

Source: NVD CVE-2026-76418

🔴 [REGULATORY MANDATE] AWIA Emergency Response Plan Deadline — December 31, 2026

Utilities serving populations of 3,301–49,999 have a legal deadline of December 31, 2026 to submit updated Emergency Response Plans (ERPs) under the America's Water Infrastructure Act. Recertified Risk and Resilience Assessments (RRAs) for this same population tier were due June 30, 2026 — if you missed that deadline, you are already out of compliance and should contact EPA immediately. For utilities serving 50,000–99,999, updated ERPs were due June 30, 2026. With fewer than 9 weeks remaining and holiday schedules compressing available work time, any utility that has not begun its ERP update should treat this as an immediate priority. EPA does not offer extensions. Non-compliance can result in enforcement action.

Source: EPA Cybersecurity for the Water Sector