The CIP Briefing

This was a high-volume week for actively exploited vulnerabilities, and several of them sit directly on the IT/OT boundary that water utilities depend on. CISA added nine new CVEs to the Known Exploited Vulnerabilities catalog between October 13 and October 16 — including critical flaws in Ivanti Connect Secure (the VPN appliance many utilities use for remote SCADA access), Palo Alto Networks PAN-OS (a common firewall at mid-size utilities), Fortinet products (widely deployed across the water sector), Cisco Secure Email Gateway, and Microsoft Windows. If your operator or contractor uses any of these products to remotely access your plant network, your SCADA environment may already be reachable by threat actors exploiting these vulnerabilities today. The Ivanti and Palo Alto flaws in particular are authentication bypass and code injection vulnerabilities — meaning an attacker doesn't need stolen credentials to get in. They just need your device to be internet-facing. On the compliance front: no new water-sector-specific CISA advisories were published in the past 7 days, but the December 31, 2026 deadline for updated Emergency Response Plans (ERPs) for utilities serving 3,301–49,999 people under AWIA is now fewer than 11 weeks away. Factor in Thanksgiving week, December holidays, and year-end board schedules, and your realistic working days to finalize that ERP are disappearing fast. This week is about patching the perimeter or severing the exposure — and finishing your compliance paperwork while you still have business days left.

🟠 [CRITICAL VULNERABILITY] Ivanti Connect Secure Authentication Bypass — CVE-2026-104935 Added to KEV Catalog

On October 13, 2026, CISA published an alert urging immediate patching of a newly exploited authentication bypass vulnerability in Ivanti Connect Secure (CVE-2026-104935). This is the VPN/remote access appliance that many water utilities rely on to give operators, integrators, and contractors remote access to SCADA and HMI systems. An authentication bypass means an attacker can gain access to your VPN gateway without valid credentials — effectively walking through the front door of your remote access infrastructure. CISA confirmed this vulnerability is under active exploitation. For any utility that uses Ivanti Connect Secure as its remote access path into the OT network, this is a direct bridge from the internet to your plant floor.

Source: CISA Alert — Ivanti Connect Secure Newly Exploited Vulnerability

🟠 [CRITICAL VULNERABILITY] Palo Alto Networks PAN-OS Code Injection — CVE-2026-0322 Added to KEV Catalog

On October 14, 2026, CISA added CVE-2026-0322 to the KEV catalog — an authenticated code injection vulnerability in the Palo Alto Networks PAN-OS management interface, the operating system running on Palo Alto firewalls. These firewalls are commonly deployed at mid-size water utilities as the primary perimeter defense between the corporate/IT network and the OT/SCADA environment. A code injection vulnerability in your firewall OS means an attacker can execute arbitrary commands on the device itself — potentially modifying firewall rules, creating backdoor access, or pivoting directly into the OT network segment the firewall is supposed to protect. This is confirmed under active exploitation.

Source: NVD CVE-2026-0322

🟠 [CRITICAL VULNERABILITY] Fortinet Multiple Products Path Traversal — CVE-2025-61624 Added to KEV Catalog

On October 16, 2026, CISA added CVE-2025-61624 to the KEV catalog — a path traversal vulnerability affecting multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Fortinet firewalls and VPN appliances are among the most widely deployed perimeter security devices in small and mid-size water utilities. This path traversal vulnerability allows an authenticated attacker with administrative privileges to write or delete arbitrary files via specific CLI commands — enabling attackers who compromise an admin account to deploy stealthy malware implants, tamper with system configurations, or sabotage the appliance. Given the water sector's heavy reliance on Fortinet for both perimeter defense and remote access VPN, this vulnerability directly threatens the IT/OT boundary at thousands of utilities.

Source: NVD CVE-2025-61624

🟠 [CRITICAL VULNERABILITY] Microsoft Windows Command Injection — CVE-2026-96951 Added to KEV Catalog

On October 13, 2026, CISA added CVE-2026-96951 to the KEV catalog — a Windows Shell Mark of the Web (MotW) security feature bypass vulnerability in Microsoft Windows. This affects the operating system running on virtually every HMI workstation, historian server, SCADA engineering station, and business IT system in the water sector. This vulnerability is triggered when a local user interacts with and opens a specially crafted malicious file delivered via email, web download, or USB, bypassing Mark of the Web protections. In an OT context, this could mean an operator accidentally launching malware that leads to direct manipulation of HMI software, data exfiltration from historian databases, or deployment of ransomware across interconnected Windows-based control systems.

Source: NVD CVE-2026-96951

🔴 [REGULATORY MANDATE] AWIA ERP Deadline — Fewer Than 11 Weeks Remaining for Systems Serving 3,301–49,999

No new EPA or CISA water-sector-specific advisories were published in the past 7 days, but the compliance clock continues. Utilities serving 3,301–49,999 people face a legally mandated December 31, 2026 deadline for submission of updated Emergency Response Plans (ERPs) under the America's Water Infrastructure Act. Utilities serving 50,000–99,999 people whose updated ERPs were due June 30, 2026 should confirm their submissions were accepted. Additionally, utilities in the 3,301–49,999 population tier whose recertified Risk and Resilience Assessments (RRAs) were due June 30, 2026 should verify that those certifications are on file before pivoting to the ERP update. The holidays will consume at least 2–3 of the remaining 11 weeks. Treat this as an 8-week working window.

Source: EPA Cybersecurity for the Water Sector