The CIP Briefing

This was a high-volume week on the federal vulnerability front, and two items demand your immediate attention. First: CISA released a dedicated alert on September 27 for critical zero-day vulnerabilities actively exploited in Citrix NetScaler ADC and Gateway — two CVEs added to the KEV catalog the same day. If your utility or your managed service provider uses Citrix for remote access or load balancing (and many do for VPN-based remote SCADA access), you may already be compromised. Zero-day means there was no patch available when exploitation began. Second: MikroTik RouterOS — the cheap, ubiquitous router platform found in countless small utility networks and remote pump station enclosures — picked up a KEV entry on September 25 for an improper enforcement of behavioral workflow vulnerability. If you have a MikroTik device sitting between your corporate network and a remote site, an attacker can abuse this flaw to bypass security controls. Beyond the technical threats, CISA published a new Fact Sheet on September 23 covering third-party ICS integrator risk — directly relevant to every utility that hires outside contractors to configure PLCs, install SCADA systems, or manage remote access. On the compliance clock: utilities serving 3,301–49,999 people now have fewer than 14 weeks until the December 31, 2026 deadline for updated Emergency Response Plans under AWIA. If your plan isn't drafted yet, you are running out of runway. Use this week's intelligence to close gaps before they become incidents — or audit findings.

🟠 [CRITICAL VULNERABILITY] Citrix NetScaler ADC and Gateway — Active Zero-Day Exploitation (CVE-2026-88772, CVE-2026-88771)

On September 27, 2026, CISA issued a dedicated alert and simultaneously added two Citrix NetScaler vulnerabilities to the Known Exploited Vulnerabilities catalog. CVE-2026-88772 is an improper restriction of operations within the bounds of a memory buffer (buffer overflow), and CVE-2026-88771 is an improper input validation flaw. Both are confirmed actively exploited as zero-days. Citrix NetScaler ADC and Gateway appliances are commonly deployed as VPN concentrators, remote access gateways, and application delivery controllers. In the water sector, these devices are frequently the front door for remote SCADA access — engineers, operators, and IT contractors connect through them to reach HMIs, historians, and engineering workstations. A buffer overflow in a remote access gateway means an attacker can execute arbitrary code on the device itself, potentially intercepting all traffic passing through it, harvesting VPN credentials, or pivoting directly into the OT network behind it. The input validation flaw compounds this by providing a second exploitation path. Because these were zero-days, there was a window — duration unknown — where no patch existed and exploitation was already underway. Any utility running Citrix NetScaler for remote access must treat this as a potential compromise, not just a patching exercise.

Source: CISA Alert — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

🟠 [CRITICAL VULNERABILITY] MikroTik RouterOS — Improper Enforcement of Behavioral Workflow (CVE-2026-67279)

On September 25, 2026, CISA added CVE-2026-67279 to the KEV catalog. This is an improper enforcement of behavioral workflow vulnerability in MikroTik RouterOS, confirmed actively exploited. MikroTik routers are among the most commonly deployed networking devices in small and mid-size water utility environments due to their low cost. They are frequently used at remote pump stations, well sites, tank sites, and as site-to-site VPN endpoints connecting field infrastructure back to the main SCADA network. This vulnerability allows an attacker to bypass intended security workflow controls on the router — effectively circumventing firewall rules, access control lists, or VPN authentication mechanisms that the device is supposed to enforce. For a utility relying on a MikroTik router as the sole network boundary device at a remote well or lift station, successful exploitation means an attacker can reach the OT devices behind it — PLCs, RTUs, and variable frequency drives — without triggering the security controls the operator believed were in place.

Source: NVD CVE-2026-67279

🟡 [ACTIVE THREAT INTEL] CISA Fact Sheet: Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

On September 23, 2026, CISA published a new Fact Sheet titled "Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators." This resource is aimed squarely at utilities and other critical infrastructure operators who hire outside system integrators to design, install, configure, or maintain ICS/SCADA systems. The fact sheet addresses a fundamental risk in the water sector: most small and mid-size utilities do not have in-house OT cybersecurity expertise and rely entirely on third-party integrators for PLC programming, HMI configuration, network architecture, and remote access setup. The guidance covers contractual requirements, access management, credential hygiene, and the need to verify that integrators are not introducing unmanaged remote access paths into OT networks. This is not a vulnerability alert — it is a strategic risk management document that should inform how your utility contracts with and oversees its SCADA integrators going forward.

Source: CISA Fact Sheet — Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

🔴 [REGULATORY MANDATE] AWIA Compliance Clock — December 31, 2026 ERP Deadline Now Under 14 Weeks

No new EPA enforcement actions or water-sector-specific advisories were published in the past 7 days. However, the compliance clock continues to advance. Utilities serving 3,301–49,999 people must submit updated Emergency Response Plans (ERPs) by December 31, 2026. That is now fewer than 14 weeks away. Utilities serving 50,000–99,999 people had their ERP deadline on June 30, 2026 — if you have not yet certified, you are already out of compliance and should contact your EPA regional office immediately. Under CIRCIA, the 72-hour reporting clock begins the moment a covered entity "reasonably believes" a qualifying cyber incident has occurred. Ransomware payments must be reported within 24 hours.

Source: EPA Cybersecurity for the Water Sector