(TLP:CLEAR) CISA ICS Advisories, Additional Alerts, Updates, and Bulletins – September 24, 2026

The Cybersecurity and Infrastructure Security Agency (CISA) has published the following ICS security advisories, along with additional alerts, updates, and bulletins:

ICS Advisories:

On September 22, 2026, CISA Released Nine Industrial Control Systems Advisories for products used across multiple sectors, please check these latest advisories for specific equipment used across your ICS/SCADA environments and address accordingly:

• lwIP TCP/IP Stack MQTT Client Application – Used in Water and Wastewater Systems and Energy
• lwIP (Lightweight IP) – Used in Water and Wastewater Systems and Energy
• Siemens Siveillance Control
• Siemens SIPLUS and SIMATIC Products – Used in Water and Wastewater Systems and Energy
• Siemens Desigo CC family
• Siemens Industrial Edge Management
• Siemens SIMOVE Fleetmanager and SIPLANT
• Siemens WTV676 and WTV776 – Used in Energy
• OpenPLC Runtime v3 – Used in Water and Wastewater Systems and Energy

Additional Alerts, Updates, and Bulletins:

• September 22 – CISA Adds Four Known Exploited Vulnerabilities to Catalog
• September 21 – CISA Adds One Known Exploited Vulnerability to Catalog
• September 18 – CISA Adds One Known Exploited Vulnerability to Catalog
• September 18 – CISA Adds Two Known Exploited Vulnerabilities to Catalog
• Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
• CVE Program: Establishing a Quality Era Framework
• CISA Election Report
• Recognizing and Addressing Threats to Statewide Voter Registration Databases