UTILITY OT / FIELD SIGNALS

Utility OT Threat & Readiness Watch

AI-assisted monitoring; sources and material alerts editorially reviewed before publication.

PUBLISHED / 2026.07.22

LAST REVIEWED / 2026.09.01

URGENT

AFFECTED PATH / Internet-connected PLCs / SCADA

Iranian-affiliated actors target water and wastewater systems

What happened: CISA, NSA, and FBI warned that Iranian-affiliated cyber actors were actively targeting and compromising internet-connected PLCs and SCADA equipment in the Water and Wastewater Systems Sector.

Why utilities should care: Externally reachable control assets can become an operational pathway—not just an IT finding.

Verify now: Inventory internet-exposed PLC/SCADA interfaces; remove public exposure where not required; review access controls and logs.

SEEOPERATE

CISA AA26-097A

PUBLISHED / 2026.03.17

LAST REVIEWED / 2026.09.01

HIGH

AFFECTED PATH / Schneider Electric SCADAPack x70 / RemoteConnect

Improper condition check affects Modbus TCP communication

What happened: CISA’s advisory for SCADAPack x70 RTUs and RemoteConnect identified CVE-2026-0667, which can enable denial of service or code execution.

Why utilities should care: Remote terminal units sit close to physical process. Availability and trust in Modbus paths are operational concerns.

Verify now: Confirm affected firmware and RemoteConnect versions; review Modbus TCP exposure and vendor mitigations.

SEERESTORE & TRUST

CISA ICSA-26-076-02

PUBLISHED / 2026.02.24

LAST REVIEWED / 2026.09.01

HIGH

AFFECTED PATH / InSAT MasterSCADA BUK-TS

SQL and OS command injection vulnerabilities disclosed

What happened: CISA reported SQL injection and OS command injection vulnerabilities affecting all versions of InSAT MasterSCADA BUK-TS.

Why utilities should care: Command injection in supervisory software can collapse the boundary between monitoring and unauthorized action.

Verify now: Identify deployments; isolate management interfaces; validate vendor guidance and administrative access paths.

SEEOWN

CISA ICSA-26-055-01

PUBLISHED / 2026.04.02

LAST REVIEWED / 2026.09.01

MEDIUM

AFFECTED PATH / Schneider Electric EcoStruxure

Local privilege escalation advisory republished

What happened: CISA republished an advisory covering a local privilege escalation vulnerability in Schneider Electric EcoStruxure.

Why utilities should care: Privilege boundaries on engineering and operator workstations are part of the control system’s trust model.

Verify now: Check affected EcoStruxure components and versions; review local privilege assignments on engineering workstations.

OWNPROVE

CISA ICSA-25-037-02

PUBLISHED / 2025.12.18

LAST REVIEWED / 2026.09.01

HIGH

AFFECTED PATH / Water and wastewater OT / remote access

CISA urges water systems to reduce internet-exposed OT risk

What happened: CISA’s water-sector guidance emphasizes reducing internet exposure, strengthening access controls, and preparing for loss of control-system visibility.

Why utilities should care: A resilient operating model assumes that remote access and visibility may be constrained at the worst moment.

Verify now: Test offline contacts and manual operating procedures; confirm remote access is inventoried, approved, and monitored.

OPERATERESTORE & TRUSTPROVE

CISA Water and Wastewater Systems

PUBLISHED / 2025.11.20

LAST REVIEWED / 2026.09.01

MEDIUM

AFFECTED PATH / Industrial control systems / vulnerability management

CISA continues publishing ICS advisories for operational technology

What happened: CISA’s ICS advisory program provides vendor-specific information about vulnerabilities, mitigations, and affected products for control-system defenders.

Why utilities should care: A repeatable review rhythm is more useful than waiting for a headline to define the week’s priority.

Verify now: Assign ownership for advisory triage; map vendor notices to asset inventory and operational change windows.

OWNPROVE

CISA ICS Advisories