Strategy & OperationsLegislative AffairsManufacturing & Materials
CISA Warns of Multi-State Cybersecurity Attacks on Utilities
Water utilities are told to disconnect, not to patch.
Federal agencies told water utilities to disconnect the equipment that runs their pumps and valves from the internet. They did not tell them to install a fix, because no federal or vendor document names anything broken to fix. The work is therefore rewiring networks, finding every device and sending staff to each site, not a software update. It falls hardest on the small utilities that connected the equipment in the first place because they could not staff every site.
- The FBI and EPA public service announcement and CISA's alert of July 30, 2026 both describe actors reaching internet-facing MicroLogix 1100 and 1400 controllers, changing IP addresses and setting passwords, and neither cites a CVE, a severity score or a weakness class. Rockwell Automation's own recovery notice states that no CVE is associated with it.
- The unpatchable-flaw framing traces to ICSA-21-056-03, the 2021 advisory for CVE-2021-22681, whose affected-products list is seventeen Logix-family controllers and does not include MicroLogix. The April 2026 advisory that cites that identifier does so once, in a reading list, and gives internet-accessible device as its initial-access technique.
- Recovery is physical and per site: a locked MicroLogix 1400 is restored by removing its battery to clear memory, a locked 1100 by a firmware update over a serial connection. The procedure erases the program, and the FBI and EPA warn that at least one organization found modified project files after noticing ladder logic discrepancies across several sites, so backups must be validated first.
- The FBI and EPA named a propagation channel no federal program measures: similarities in network setup provided by third parties, which may let actors multiply successes across customers. Statutory risk assessments under AWIA Section 2013 are scoped to a single system, so a shared build is an exposure no individual utility's assessment is designed to detect.
- The instruction is advice. AWIA requires a system serving more than 3,300 people to assess its risks and plan a response, not to fix anything found, and EPA receives a certification rather than the assessment. EPA's one attempt to add cybersecurity to state sanitary surveys was stayed in July 2023 and withdrawn that October, and both July 30 documents route readers to a request-based technical assistance form.
No Vulnerability, No Patch, and a Remedy Made of Labor
Between July 26 and 27, more than 30 Minnesota community water systems were targeted at once, and by July 30 the FBI had reports from utilities in at least seven states. The devices involved are small programmable logic controllers, the boxes that decide when a pump starts and when a valve opens. Nobody broke them. Someone changed the network address each controller answers on and switched on a password that had never been set, using services the industrial protocol these devices speak is specified to provide. Everything downstream follows from that: no identifier, no software update, and a remediation made of architecture and labor.
- The Federal Instruction. The FBI and EPA public service announcement and CISA's alert, both dated July 30, tell utilities to take the controllers off the public-facing internet and broker any remote access through a secure gateway or jump host, with allowlisted sources and cellular modems secured, updated and logged. Neither document cites a A public identifier assigned to a specific software or hardware defect. Its absence from the documents here is the point: a device doing what its specification says it does is not a defect., a severity score or a weakness class, and neither cross-references CISA's April advisory on Rockwell A programmable logic controller, the small industrial computer that runs a physical process, deciding when a pump starts, when a valve opens and when an alarm sounds. targeting.
- Where the Missing Patch Came From. The sentence that a Rockwell vulnerability cannot be mitigated with a patch is real, and it belongs to ICSA-21-056-03, the 2021 advisory for CVE-2021-22681. That advisory's affected-products list is seventeen Logix-family controllers reached through the Studio 5000 and RSLogix 5000 toolchain. MicroLogix appears nowhere in it. MicroLogix controllers are programmed with RSLogix 500 instead.
- The Manufacturer Rules It Out. Rockwell Automation's notice SD1790, published July 30, is the document CISA points MicroLogix owners toward. It states that no CVE is associated with the notice and that it is operational recovery guidance rather than a vulnerability disclosure, and it describes actors turning on and setting passwords where no passwords were previously set.
- What the April Advisory Actually Says. AA26-097A, the advisory that carries the CVE reference, does not cite it as the access method. Its initial-access technique is internet-accessible device, and its own account is that actors used configuration software to create an accepted connection to controllers deployed without sufficient network and hardening security controls. Its named targets are CompactLogix and Micro850, and Micro850 is a Micro800-family controller that is not on the CVE's affected-products list either.
- Recovery Is Physical. Per the vendor notice, a locked MicroLogix 1400 is recovered by powering it down and removing its battery to clear memory; a locked 1100 needs a firmware update over a serial connection. The procedure erases the program, so it also requires a trusted offline copy of the project file, and the FBI and EPA warn that at least one organization found modified project files after noticing The rung-by-rung control program a PLC runs, held in a project file. Changing it changes the rules the plant obeys without changing what the operator's screen shows. discrepancies across several sites.
There Is No Patch Because There Is No Defect
The July 30 documents name no public vulnerability identifier, no severity score and no weakness class, and the manufacturer's own notice of the same date says outright that none is associated with it and that the document is operational recovery guidance rather than a vulnerability disclosure. That is not an omission. A controller's network address is a settable attribute of a standard object in the industrial protocol, and the controller password on this product line is an opt-in feature nobody had switched on. Querying a device for what it is happens to be a service the protocol is specified to provide. Firmware that refused a well-formed request on a service it is specified to offer would break commissioning, which is why the federal mitigation lists carry no software update.
The patch sentence in circulation belongs to a different advisory and a different product. "Cannot be mitigated with a patch" comes from the 2021 Rockwell advisory for CVE-2021-22681, whose affected-products list is seventeen Logix-family controllers reached through the Studio 5000 and RSLogix 5000 toolchain. MicroLogix appears nowhere on it, because MicroLogix controllers are programmed with RSLogix 500 instead. Even the April advisory that carries that identifier does not name it as the access method: its initial-access technique is an internet-accessible device, and one of its two named targets is not on the affected-products list either.
What is left is architecture and labor. Authentication, message integrity and encryption reach the base protocol only through a security extension present where a device implements it, so the only lever anyone has is who can reach the port: controllers off the public internet, remote access brokered through a gateway or jump host, allowlisted sources, cellular modems secured and logged. Recovery is physical too. A locked MicroLogix 1400 is cleared by powering it down and pulling its battery; an 1100 needs a firmware update over a serial connection. The procedure erases the program, so it also requires a trusted offline copy of the project file.
The exposure runs through who can reach the port
Cybersecurity & Privacy. A controller's network address is a settable attribute of a standard object in the industrial protocol, and the controller password on this product line is an opt-in feature that had not been set. The same standard object carries mandatory read-only attributes including vendor ID, device type, product code and revision, and the protocol's founding design paper states that this data can be queried from a target node without knowing physically what that device is before the message is issued. Enumeration is a specified service, not a discovered weakness, which is why the exposure claim here does not rest on a scan. Authentication, message integrity and encryption reach the base EtherNet/IP protocol only through CIP Security, which ODVA describes as a network extension, present only where a device implements it. Firmware that refused a well-formed request on a service it is specified to offer would break commissioning, which is why the federal mitigation lists contain no software update.
Manufacturing & Materials. CISA's sharpest sentence is about assets nobody knows they own: the targeting includes cellular modems installed by operators, vendors or system integrators that may not be documented or included in routine attack surface scans. A modem at an unstaffed well gives the controller a second path that never crosses the utility's firewall. Censys counted 4,148 hosts self-identifying as Rockwell or Allen-Bradley on EtherNet/IP in a July 30 snapshot, with cellular carriers accounting for 59.0% of them, and states plainly that this is an exposure characterization and not a list of victims.
A vulnerability identifier issues for the July activity on this controller line, or the vendor ships firmware that refuses the request. There would have been a defect to patch after all.
On the security side: enumeration is a service the protocol is specified to offer, so which layer decides who may ask, the device, the network or the integrator who specified it?
One design reached many towns at once
Manufacturing & Materials. The FBI and EPA wrote that similarities in network setup provided by third parties may let actors multiply successes across customers. Repeatable builds are what make control systems affordable for a town that cannot employ a controls engineer: the Control System Integrators Association audits member firms against a defined system development life cycle, the discipline that produces exactly that reuse. The efficiency and the correlation are the same property. No federal document identifies any specific shared build, any firm or any association, and the agencies wrote may, not did.
Public Administration. A statutory risk assessment cannot see it. AWIA Section 2013 requires each community water system serving more than 3,300 people to assess the risks to and resilience of its system, an enumerated scope covering its own assets and practices, reviewed at least once every five years. An exposure that exists between utilities is invisible to an instrument that looks only inside one, and systems at or below 3,300 people sit outside the requirement altogether. Nor does the voluntary channel close the gap. EPA's own paper on building cybersecurity into revolving-fund projects says of its free evaluation program that the assessment and the mitigation plan remain private between the utility and the contractor, and that EPA does not receive any utility-specific information.
A federal or state product examines the affected utilities and finds independently specified builds from different integrators. The correlation would sit somewhere other than a shared design.
On the oversight side: no federal program measures, licenses or inspects the integrator market, so who could ever establish that one shared build carried an attack across towns?
The remedy withdraws a substitute for staff
Strategy & Operations. CISA reports nationally that the activity has resulted in boil water notices and sustained manual operations, and the FBI and EPA say the severity at each victim turned partly on the site's capability to switch to manual operations. That the connection stands in for a person is not an inference. Daniel Willems of the Environmental Finance Center at the University of North Carolina writes that sharing an operator between systems works because most treatment plants do not need an operator on site at all times, and that this is especially true given the ability to monitor SCADA remotely over the internet, leaving some operators on site a few times a week for a few hours. Manual operation is not a setting. It is a staffed shift, a certified operator, a written procedure and a tested drill, drawn from a national pool of 132,400 water and wastewater operators, in a sector where EPA projected in 2020 that a third of employees would be eligible to retire within ten years.
Legislative Affairs. Financing already exists for the hardware half: EPA lists cyber security among eligible resiliency improvements for both state revolving funds, on the same list that covers telemetry systems for remote operation, so the channel that underwrote the remote-access build-out is available to fund its partial reversal. What has no channel is the recurring half. Log review, drills and site visits land in the operating budget and hit rates in the year they are incurred.
A revolving fund or grant program makes the recurring work eligible, log review, drills and site visits, not only the gateway hardware. The labor half would have a financing channel.
On the operations side: manual operation is a staffed shift rather than a setting, so where does a system serving 1,769 people find the hours once the remote path is gone?
The Weave maps a single development across domains and across time. Each row follows one domain from where things stand now through the next eighteen months, and expands for the reasoning behind that trajectory.
- A compliant remote-access architecture has a cost floor that does not scale down with population.
- Most systems are small, so the same fixed build lands on a rate base of a few thousand people.
- The gap is organizational too: a small town buys its operations as a service and has no owner to assign.
- The pending model would have EPA certify a private organization to write and enforce the rules.
- Penalties capped at $25,000 a day would fund that certified organization's own operations.
- Whether Congress accepts delegated standards is the question this event puts back on the table.
- A utility that documents an exposed controller and leaves it exposed is in full compliance with the law.
- Systems serving 3,300 people or fewer sit outside the assessment requirement altogether.
- The one attempt to add cybersecurity review to state inspections was stayed and then withdrawn.
- Disconnection takes away the access but leaves any modification to the logic still running.
- Comparing the running program against known-good logic presumes a baseline, a license and a reader.
- Switching a controller to run mode locks in whatever program is loaded, so an unvalidated backup sticks.
v1 · August 3, 2026Gateways Are Easy to Buy. The Capability Is What Decides
One dated federal certification requirement sits inside the forward window. Everything else in this story is a signal that either appears or does not, and each of the following can be checked against a published record.
- The December Certification. Community water systems serving 3,301 to 49,999 people must certify an emergency response plan by December 31, 2026, six months after the risk-assessment certification date that passed about four weeks before the attacks. Individual systems run on a five-year clock from their own prior certification, so this is a class-wide date rather than a universal one, and what it certifies is a written plan, not a controller's exposure.
- A Follow-On Federal Product. Whether CISA, EPA or the Water Sector Coordinating Council publishes anything that characterizes the shared third-party network setups the FBI and EPA flagged. Such a document would convert a stated mechanism into a documented cause. Its absence is why the propagation finding remains a hypothesis the agencies themselves wrote as may, and why no federal program currently measures the market that produces the builds.
- Whether States Keep Outrunning EPA. The sharpest instrument in the sector is Idaho's. Its environmental quality department awards revolving-fund scoring points for Cyber-Informed Engineering, an approach EPA's own paper on revolving-fund projects describes as emphasizing the design of engineered cyber controls into the infrastructure. That is a funding lever that pays for engineering rather than paperwork. The same paper records that Indiana requires all community water systems to fold cybersecurity risk assessments into their asset management plans, and that New York requires systems serving 3,301 or more people to file a five-year emergency plan carrying a cybersecurity vulnerability analysis. States are already requiring what the federal record cannot collect, and whether others copy Idaho is checkable.
- Whether the Vendor List Grows. The FBI says it has only observed this behavior with the referenced Rockwell controllers but that similar considerations should be made with other branded PLCs, and CISA's July 22 update had already widened observed targeting to Schneider Electric and Siemens. Any product name treated as the boundary of the problem is a snapshot with an expiry date, and so is any state count.
- The Tell. If the sector's answer is gateways and the operating budgets do not move, the exposure returns the first time a utility needs to see a remote site and has nobody to send. If utilities instead start holding verified offline project files, practicing manual operation at unstaffed sites and inventorying the modems installed on their behalf, the capability that decides the next event was actually built. The first is easier to buy. The second is what the federal documents ask for.
Every issue
- 01Intersection of the week
- 02Impact of the week
- 03The week in review
Wiiver Weekly
One free email, Saturdays at 7:00 AM ET.
Unsubscribe anytime.
Primary sources39
- FBI and EPA (public service announcement)Malicious Cyber Actors Targeting Water and Wastewater Sector Programmable Logic Controllers (I-073026-PSA)Jul 30Primary · One design reached many towns at once · The remedy withdraws a substitute for staff · Why is the only federal instruction to unplug it? · Looking Forward · Where Things Stand · The Weave
- CISA (alert)CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCsJul 30Primary · The exposure runs through who can reach the port · The remedy withdraws a substitute for staff · Why is the only federal instruction to unplug it? · Where Things Stand · The Weave
- Rockwell Automation (security advisory SD1790)IMPORTANT NOTICE: Restoring Access to MicroLogix 1400 and MicroLogix 1100 Controllers When the Password Is Unknown, and Hardening Guidance (SD1790, rev 3.0)Jul 30Primary · The exposure runs through who can reach the port · Why is the only federal instruction to unplug it? · Where Things Stand · The Weave
- CISA (ICS advisory)ICSA-21-056-03: Rockwell Automation Logix Controllers (Update A), CVE-2021-22681Feb 25Primary · Why is the only federal instruction to unplug it? · Where Things Stand
- CISA (joint cybersecurity advisory)AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (initial 7 April 2026, updated 22 July 2026)Apr 7Primary · Why is the only federal instruction to unplug it? · Looking Forward · Where Things Stand
- U.S. Code (SDWA Section 1433, as amended by AWIA Section 2013)42 U.S.C. 300i-2, Risk and resilience assessments and emergency response plansOct 23Primary · One design reached many towns at once · Looking Forward · The Weave
- EPA (AWIA Section 2013)America's Water Infrastructure Act (AWIA) Section 2013: risk and resilience assessment and emergency response plan certification deadlinesPrimary · Looking Forward
- EPA (certification instructions)How to Certify Your Risk and Resilience Assessment or Emergency Response PlanPrimary · The Weave
- EPA (sanitary surveys memorandum record)Cybersecurity in Sanitary Surveys: the March 3, 2023 interpretive memorandum and its October 11, 2023 withdrawalOct 11Primary · The Weave
- GAOCritical Infrastructure Protection: EPA Urgently Needs a Strategy to Address Cybersecurity Risks to Water and Wastewater Systems (GAO-24-106744)Aug 1Primary · The Weave
- CRS (Congressional Research Service)Cybersecurity of the Municipal Water Sector: Background and Issues for Congress (R48556)Jun 3Primary · One design reached many towns at once · The Weave
- NIST (CSRC publication record)SP 1800-45, Cybersecurity for the Water and Wastewater Sector: Build Architecture (Operational Technology Remote Access), finalJun 24Primary · The Weave
- NIST (announcement)NIST Guidelines for Secure Remote Access in Water and Wastewater SystemsJun 24Primary ·
- Rockwell Automation (catalog record, MicroLogix 1400)Catalog detail 1766-L32AWA: MicroLogix 1400 lifecycle statusPrimary · Why is the only federal instruction to unplug it?
- Rockwell Automation (catalog record, MicroLogix 1100)Catalog detail 1763-L16AWA: MicroLogix 1100 lifecycle statusPrimary · Why is the only federal instruction to unplug it?
- Rockwell Automation (lifecycle definitions)Product Lifecycle Status definitionsPrimary · Why is the only federal instruction to unplug it?
- ODVACIP SecurityPrimary · The exposure runs through who can reach the port
- Minnesota IT ServicesState response to coordinated cyberattack on Minnesota community water systems (posts of 28 and 30 July 2026)Jul 28Primary · Where Things Stand
- CRS (Congressional Research Service)Small Water Systems: Selected Safe Drinking Water Act Provisions (R47315), SDWIS data as of June 2022Nov 22Primary · The remedy withdraws a substitute for staff · Why is the only federal instruction to unplug it? · The Weave
- O*NET / Bureau of Labor StatisticsWater and Wastewater Treatment Plant and System Operators (SOC 51-8031)May 19Primary · The remedy withdraws a substitute for staff · The Weave
- EPA (funding eligibility)EPA State Revolving Funds and Grants Available to Water and Wastewater UtilitiesPrimary · The remedy withdraws a substitute for staff · Why is the only federal instruction to unplug it? · The Weave
- EPA (water-sector cybersecurity)Cybersecurity for the Water SectorSep 29Primary · The remedy withdraws a substitute for staff · The Weave
- MITRE ATT&CK for ICSLoss of View (T0829)May 12Primary · Where Things Stand
- WSSC WaterWho We Are and Information Technology organizationPrimary · Why is the only federal instruction to unplug it? · The Weave
- City of Braham, MinnesotaWater and Sewer; Public WorksPrimary · Why is the only federal instruction to unplug it?
- GovInfo (H.R. 2594 text)H.R. 2594 (119th Congress), as introduced: Water Risk and Resilience OrganizationApr 2Primary · The Weave
- GovInfo (bill status, H.R. 2594)BILLSTATUS-119hr2594Primary · The Weave
- GovInfo (bill status, S. 1549)BILLSTATUS-119s1549: Water Cybersecurity Enhancement Act of 2025Primary · The Weave
- U.S. Senate Committee on Environment and Public WorksHearing to Identify and Address Cybersecurity Challenges to Protect America's Water InfrastructureFeb 4Primary · The Weave
- Control System Integrators AssociationCSIA CertificationPrimary · One design reached many towns at once · The Weave
- West Valley Water DistrictWVWD Secures over $1M from Congressman Pete Aguilar to Strengthen Water SecurityFeb 19Primary ·
- CISA (joint cybersecurity advisory)AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems FacilitiesDec 1Primary · The Weave
- EPA (technical assistance program)Cybersecurity Technical Assistance Program for the Water SectorPrimary ·
- GAOCritical Infrastructure Protection: Actions Needed to Address Persistent Cybersecurity Threats to the Water and Wastewater Sector (GAO-26-109159)May 21Primary ·
- Rockwell Automation / IEEE EFTA (white paper)EtherNet/IP: Industrial Protocol White Paper (ENET-WP001A-EN-P), by Paul Brooks, published via IEEE EFTA 2001Oct 1Primary · The exposure runs through who can reach the port · Why is the only federal instruction to unplug it?
- ODVA (technology overview)EtherNet/IP: CIP on Ethernet Technology (PUB00138R8), February 2024Feb 1Primary · Why is the only federal instruction to unplug it?
- EPA Office of Water (SRF cybersecurity paper)Strengthening and Integrating Cybersecurity Measures into State Revolving Fund (SRF) Funded Projects (EPA 832-R25-001)Oct 1Primary · One design reached many towns at once · Looking Forward
- CISA (joint cybersecurity advisory)AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical InfrastructureFeb 7Primary · The Weave
- CISA (Known Exploited Vulnerabilities catalog)Known Exploited Vulnerabilities Catalog, CVE-2021-22681 record (dateAdded 5 March 2026)Mar 5Primary ·
Secondary sources, by sector7
- AWWA (American Water Works Association)Report finds rising drinking water infrastructure costs and other needs put affordability at riskMar 26Secondary · Why is the only federal instruction to unplug it? · The Weave
- Environmental Finance Center at UNC (EFC Network)Operating at a Deficit: Solutions to a Water and Wastewater Operator Shortage, by Daniel WillemsSecondary · The remedy withdraws a substitute for staff
- Censys (ARC Research)Exposure characterization following the CISA alert on water-sector PLC targetingJul 30Secondary · The exposure runs through who can reach the port · The Weave
- Tenable (Research Special Operations)Coordinated Cyberattack on Minnesota Water Utilities: What You Need to KnowJul 28Secondary · Why is the only federal instruction to unplug it?
- SecurityWeekPoland's ABW discloses 2025 compromises of operational systems at municipal water plantsMay 8Secondary · The Weave
- NBC NewsHackers targeted municipal water systems in 7 states this week, FBI saysJul 31Secondary · Why is the only federal instruction to unplug it? · The Weave
- StateScoopMinnesota water utility cyberattacks: officials decline to attribute, and it is unclear which controllers were involvedJul 28Secondary · Why is the only federal instruction to unplug it?