The CIP Briefing

Two items this week demand your attention — one is a persistent threat that won't go away, and the other is a compliance clock that just got louder. Citrix NetScaler picked up a third KEV entry on October 4 — a new buffer overflow vulnerability (CVE-2026-88779) added just one week after the two zero-days we covered last issue. If you patched last week and thought you were done, you're not. This is a different CVE, and it means Citrix's remote access platform remains under sustained, active attack. If NetScaler is your VPN gateway into SCADA, your IT contractor needs to verify this new patch is applied today, not next maintenance window. Separately, Fortinet FortiMail — the email security gateway used by many small and mid-size utilities — received a KEV entry on October 1 for a path traversal vulnerability (CVE-2026-104286). If an attacker can traverse directories on your email gateway, they can potentially harvest credentials, pivot to internal systems, or stage phishing campaigns from your own infrastructure. On the compliance front: utilities serving 3,301–49,999 people now have fewer than 13 weeks until the December 31, 2026 deadline for updated Emergency Response Plans under AWIA. That's not "next quarter" — that's this quarter, and the holidays will eat half of it. If you haven't started drafting, you need a pen in hand this week, not next month.

🟠 [CRITICAL VULNERABILITY] Citrix NetScaler — New Buffer Overflow Vulnerability Under Active Exploitation (CVE-2026-88779)

On October 4, 2026, CISA added CVE-2026-88779 to the Known Exploited Vulnerabilities catalog. This is an improper restriction of operations within the bounds of a memory buffer vulnerability in Citrix NetScaler, confirmed actively exploited. This is the third Citrix NetScaler CVE added to the KEV catalog in eight days — following CVE-2026-88772 and CVE-2026-88771 added on September 27. The sustained cadence of exploitation against this product line indicates that threat actors are systematically probing and exploiting the NetScaler attack surface. For water utilities using NetScaler as their VPN gateway or remote access concentrator for SCADA and HMI systems, this is not a one-and-done patching situation — it is an ongoing campaign against the exact device that bridges your corporate IT network to your operational technology environment. A buffer overflow on a remote access gateway can give an attacker arbitrary code execution on the device itself, potentially allowing credential harvesting, traffic interception, or direct lateral movement into OT networks.

Source: CISA Alert — CISA Adds One Known Exploited Vulnerability to Catalog (October 4, 2026)

🟠 [CRITICAL VULNERABILITY] Fortinet FortiMail — Path Traversal Vulnerability Under Active Exploitation (CVE-2026-104286)

On October 1, 2026, CISA added CVE-2026-104286 to the KEV catalog. This is a path traversal vulnerability in Fortinet FortiMail, confirmed actively exploited. FortiMail is a dedicated email security gateway widely deployed by small and mid-size organizations — including water and wastewater utilities — for spam filtering, malware scanning, and email hygiene. A path traversal flaw allows an attacker to escape the intended directory structure and access arbitrary files on the appliance. In practical terms, this means an attacker could read configuration files, extract stored credentials, access email queues containing sensitive operational communications (including SCADA alarm notifications), or use the compromised appliance as a staging point for deeper network intrusion. Because email gateways sit at the perimeter and often have implicit trust within the network, a compromised FortiMail appliance can bypass many downstream security controls. Utilities that receive SCADA alarm emails, vendor communications, or remote access credentials via email should treat this as a high-priority patching event.

Source: CISA Alert — CISA Adds One Known Exploited Vulnerability to Catalog (October 1, 2026)

🔴 [REGULATORY MANDATE] AWIA Compliance Countdown — Emergency Response Plans Due December 31, 2026

Utilities serving 3,301–49,999 people have fewer than 13 weeks remaining until the December 31, 2026 federal deadline for submitting updated Emergency Response Plans (ERPs) under the America's Water Infrastructure Act. This is a legally binding requirement — not a recommendation. Utilities serving 50,000–99,999 people face a separate, earlier deadline of June 30, 2026 for updated ERPs, which has already passed. If your utility is in the 3,301–49,999 tier and you have not yet begun drafting your updated ERP, the remaining calendar time — factoring in Thanksgiving, Christmas, and year-end operations — leaves approximately 8–9 usable working weeks. ERPs must incorporate findings from your recertified Risk and Resilience Assessment (RRA), which was due June 30, 2026 for this same population tier. If your RRA is not yet complete, both deliverables are now overdue or at risk.

Source: EPA Cybersecurity for the Water Sector