The CIP Briefing

A quieter week on the federal advisory front — no new water-sector-specific advisories from CISA or EPA in the past 7 days — but do not mistake silence for safety. CISA added seven new Known Exploited Vulnerabilities between September 14 and September 18, and two of them hit equipment that small and mid-size utilities commonly use or connect to: a Cisco Secure Email Gateway SQL injection flaw (CVE-2026-76461) and an Acronis Backup incorrect default permissions vulnerability (CVE-2026-87886). If your utility uses Cisco's email security appliance — and many do because it's bundled in managed IT contracts — an attacker exploiting this SQL injection can manipulate backend databases, potentially extracting credentials that bridge to your OT network. The Acronis Backup vulnerability is equally dangerous for a different reason: if your IT contractor uses Acronis to back up your SCADA workstations or historian servers and the default permissions were never hardened, an attacker with network access can read, modify, or delete those backups — your last line of recovery after a ransomware event. Losing your backups means you're either paying the ransom or rebuilding from scratch. On the compliance clock: utilities serving 3,301–49,999 people now have fewer than 15 weeks until the December 31, 2026 deadline for updated Emergency Response Plans under AWIA. Utilities serving 50,000–99,999 people have the June 30, 2026 ERP deadline behind them — if you missed it, you are already out of compliance. This is also the week to use the breathing room to run a tabletop exercise. The threat actors haven't stopped; they're positioning. Use this window to harden, not to relax.

🟠 [CRITICAL VULNERABILITY] Cisco Secure Email Gateway — SQL Injection (CVE-2026-76461)

On September 14, 2026, CISA added CVE-2026-76461 to the KEV catalog. This is a SQL injection vulnerability in Cisco Secure Email Gateway, confirmed actively exploited. Cisco's email security appliance is widely deployed across water utility IT environments, often as part of a managed services contract. SQL injection in this product allows a remote attacker to execute arbitrary SQL commands against the appliance's backend database. The operational risk to water utilities is significant: Cisco email gateways frequently store or process credentials, directory service integrations (Active Directory/LDAP), and email routing rules. If compromised, an attacker can harvest credentials used across the utility's IT domain — credentials that, in flat or poorly segmented networks, may be shared with SCADA workstations, VPN concentrators, or remote access portals. This is not a theoretical IT-only concern: the email gateway is a credential store sitting on the IT side of the IT/OT boundary, and stolen credentials are the most common method for lateral movement into OT environments.

Source: NVD CVE-2026-76461

🟠 [CRITICAL VULNERABILITY] Acronis Backup — Incorrect Default Permissions (CVE-2026-87886)

On September 16, 2026, CISA added CVE-2026-87886 to the KEV catalog. This is an incorrect default permissions vulnerability in Acronis Backup, confirmed actively exploited. Acronis is used by many small utility IT contractors and managed service providers (MSPs) to perform backups of Windows workstations, servers, and — critically — SCADA historian databases and HMI configuration files. The default permissions flaw means that upon installation, backup repositories, agent configurations, or management interfaces may be accessible to unauthorized local or network users without proper restrictions. An attacker who gains any foothold on the network — even a low-privilege one — can read backup archives (extracting SCADA configuration data, stored passwords, or historian data), modify backups to inject malware that triggers on restore, or delete backups entirely. The loss or corruption of backup integrity turns a survivable ransomware incident into a catastrophic one. For utilities that rely on "we'll just restore from backup" as their ransomware recovery plan, this vulnerability eliminates that safety net.

Source: NVD CVE-2026-87886

🔴 [REGULATORY MANDATE] AWIA Compliance Countdown — 15 Weeks to December 31, 2026 ERP Deadline

No new regulatory guidance was published in the past 7 days, but the calendar doesn't stop. Utilities serving 3,301–49,999 people have fewer than 15 weeks until the December 31, 2026 deadline for updated Emergency Response Plans (ERPs) under AWIA. Recertified Risk and Resilience Assessments (RRAs) for this same population tier were due June 30, 2026 — if yours was not submitted, you are already non-compliant and should contact your EPA regional office immediately. Utilities serving 50,000–99,999 people should already have submitted their updated ERPs by June 30, 2026. Every week of delay from this point forward compresses the time your staff has to properly cross-reference the RRA findings against the ERP update, increasing the risk of a rushed, incomplete filing that won't hold up to scrutiny.

Source: EPA Cybersecurity for the Water Sector