Receipt
CISA advisories- Source
- CISA advisories (cisa_advisories)
- Grade
- A2: completely reliable, probably true
- Upstream URL
- https://www.cisa.gov/cybersecurity-advisories/all.xml
- Fetched at
- SHA-256
- e4ee191d5b2ed9ea490b7e1090584a4f7958738e5910ea0eda0dba8ee5254532
Matches the bytes served. - Raw key
- raw/cisa_advisories/2026/11/05/231029Z-e4ee191d5b2e.xml
- Size
- 935,741 bytes
- Type
- application/rss+xml
Payload
FIRST 200 LINES<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xml:base="https://www.cisa.gov/" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title>All CISA Advisories</title>
<link>https://www.cisa.gov/</link>
<description></description>
<language>en</language>
<item>
<title>Post-Quantum Questions to Ask Your Vendors</title>
<link>https://www.cisa.gov/resources-tools/resources/post-quantum-questions-ask-your-vendors</link>
<description><p>CISA, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). To protect their systems and data, organizations must plan for and transition to PQC—which includes algorithms capable of withstanding both classical computing and quantum-enabled threats—before CRQCs become available.&nbsp;</p>
<p>Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services. Cryptography is also embedded in systems and devices that are difficult to update, tied to long asset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices. Reliance on vendors means that effective PQC transition depends on vendor readiness, and early, structured engagement with these vendors is critical to planning efforts.&nbsp;</p>
<p>Organizations can use the vendor-neutral questions outlined in this guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC.&nbsp;</p>
<p>Visit CISA’s <a href="https://www.cisa.gov/topics/risk-management/quantum">PQC Initiative page</a> for additional resources.</p>
</description>
<pubDate>Thu, 05 Nov 26 12:00:00 +0000</pubDate>
<dc:creator>CISA</dc:creator>
<guid isPermaLink="false">/node/25746</guid>
</item>
<item>
<title>US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems</title>
<link>https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems</link>
<description><h2><strong>Overview</strong></h2>
<p>The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT)—hereafter referred to as “the authoring organizations”—are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally. Organizations in the <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector" title="Healthcare and Public Health">Healthcare and Public Health</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/chemical-sector" title="Chemical">Chemical</a>, <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/food-and-agriculture-sector" title="Food and Agriculture">Food and Agriculture</a>, and <a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector" title="Transportation Systems">Transportation Systems</a> Sectors widely use these systems, including in refrigerated transport services, for automated and remote monitoring of temperatures, continuous temperature logging, defrost cycle management, and energy optimization.</p>
<p>The authoring organizations urge owners and operators to defend against this activity by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.</p>
<h2><strong>Threat</strong></h2>
<p>The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.</p>
<p>Specifically, the actors may exploit these flaws through multiple vectors:</p>
<ul type="square">
<li>Authentication bypass;</li>
<li>Arbitrary code injection; and</li>
<li>Weak configurations.</li>
</ul>
<p>Upon successful exploitation of the flaws, the actors could achieve the following effects:</p>
<ul type="square">
<li>Change of temperature, which could:<br>
<ul type="circle">
<li>Affect the service life of the system;</li>
<li>Create a fire hazard;</li>
<li>Cause loss of inventory; or</li>
<li>Indirectly harm consumers if products are consumed after unsafe storage.</li>
</ul>
</li>
<li>Loss of visibility into current temperatures (a denial-of-view condition).</li>
</ul>
<h2><strong>Mitigations</strong></h2>
<p>The authoring organizations urge owners and operators to immediately take the following actions. These mitigations align with the <a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals (CPGs)">Cross-Sector Cybersecurity Performance Goals (CPGs)</a>, developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement:</p>
<ul type="square">
<li><strong>Eliminate public internet exposure</strong>: Do not expose control system devices and/or systems, particularly controller panels, to the internet [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#SecureInternetFacingDevices3S" title="CPG 3.S">CPG 3.S</a>]. Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities. See CISA’s <a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction" title="Internet Exposure Reduction Guidance">Internet Exposure Reduction Guidance</a> and <a href="https://www.cisa.gov/topics/cybersecurity-best-practices/edge-device-security" title="Defend the Edge: The Critical Importance of Edge Device Security">Defend the Edge: The Critical Importance of Edge Device Security</a> for additional guidance on securing edge devices.</li>
<li><strong>Isolate operational technology (OT) devices</strong>: Create a dedicated OT virtual local area network (VLAN) to separate OT devices from business networks [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementLogicalPhysicalNetworkSegmentation3I" title="CPG 3.I">CPG 3.I</a>].</li>
<li><strong>Enforce credential security</strong>: Change default passwords [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ChangingDefaultPasswords3A" title="CPG 3.A">CPG 3.A</a>], strengthen passwords, and implement strong password policies [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#EstablishMinimumPasswordStrength3B" title="CPG 3.B">CPG 3.B</a>]. Further, implement phishing-resistant multifactor authentication wherever feasible [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementMultifactorAuthentication3F" title="CPG 3.F">CPG 3.F</a>].</li>
<li><strong>Apply patches</strong>: Keep device firmware up to date and establish a structured lifecycle management process to identify, retire, and replace legacy devices that are at end of life (EOL) and no longer supported by the manufacturer [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ManageOrganizationalAssets2A" title="CPG 2.A">CPG 2.A</a>, <a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MitigateKnownVulnerabilities2B" title="2.B">2.B</a>]. See CISA’s <a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk" title="BOD 26-04: Prioritizing Security Updates Based on Risk">BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk</a> and <a href="https://www.cisa.gov/news-events/directives/bod-26-02-mitigating-risk-end-support-edge-devices">BOD 26-02: Mitigating Risk From End-of-Support Edge Devices</a> for additional guidance.</li>
<li><strong>Restrict access</strong>: Define and maintain device and IP address allowlisting, limiting access to only those devices and IP addresses authorized to make changes [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#ImplementthePrinciplesofLeastPrivilege3H" title="CPG 3.H">CPG 3.H</a>].</li>
<li><strong>Have reliable backups</strong>: Maintain current backups offsite and offline and test them [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainSystemBackupsRestorationAbility3O" title="CPG 3.O">CPG 3.O</a>].</li>
<li><strong>Monitor and report</strong>: Enable logging [<a href="https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0#MaintainLogCollectionStorage3Q" title="CPG 3.Q">CPG 3.Q</a>] and regularly review logs for unexpected activity.<br>
<ul type="circle">
<li>For OT assets where logs are non-standard or not available, collect network traffic and communications between the assets.</li>
</ul>
</li>
<li><strong>Review setpoint ranges</strong>: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations.</li>
</ul>
<h2><strong>Resources</strong></h2>
<p>The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems. To strengthen system security, owners and operators should review the following resources and implement recommended mitigations:</p>
<ul type="square">
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a></li>
<li>CISA: <a href="https://www.cisa.gov/topics/cybersecurity-best-practices/edge-device-security" title="Defend the Edge: The Critical Importance of Edge Device Security">Defend the Edge: The Critical Importance of Edge Device Security</a></li>
<li>CISA: <a href="https://www.cisa.gov/resources-tools/resources/exposure-reduction" title="Internet Exposure Reduction Guidance">Internet Exposure Reduction Guidance</a></li>
<li>United Kingdom’s National Cyber Security Centre and Partners:&nbsp;<a href="https://www.cisa.gov/resources-tools/resources/secure-connectivity-principles-operational-technology-ot" title="Secure Connectivity Principles for Operational Technology">Secure Connectivity Principles for OT</a></li>
</ul>
<h2><strong>Contact Information</strong></h2>
<p>The authoring organizations recommend U.S. organizations report suspicious or criminal activity related to information provided in this fact sheet:</p>
<ul type="square">
<li>Contact <strong>CISA </strong>via CISA’s 24/7 Operations Center at <a href="mailto:contact@cisa.dhs.gov">contact@cisa.dhs.gov</a> or 1-844-Say-CISA (1-844-729-2472). For more information on reporting a cyber incident, refer to CISA’s <a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia/voluntary-cyber-incident-reporting" title="Voluntary Cyber Incident Reporting">Voluntary Cyber Incident Reporting</a> web page. File a claim with <strong>FBI’s </strong><a href="https://ic3.gov/" title="Internet Crime Complaint Center (IC3)" target="_blank">Internet Crime Complaint Center (IC3)</a> or contact your local <a href="https://www.fbi.gov/contact-us/field-offices" title="FBI field office" target="_blank">FBI field office</a>. When available, please include the following information regarding the incident:<br>
<ul type="circle">
<li>Date, time, and location of the incident;</li>
<li>Type of activity;</li>
<li>Number of people affected;</li>
<li>Type of equipment used for the activity; and</li>
<li>Name of the submitting company or organization, and a designated point of contact.</li>
</ul>
</li>
<li>Contact <strong>HHS</strong> via&nbsp;<a href="mailto:HHSCyber@hhs.gov">HHSCyber@hhs.gov</a> or the HHS 24/7 Operations Center at 202-619-7800 for assistance mitigating potential disruptions to the delivery of healthcare resulting from health and medical supply chain impacts.</li>
</ul>
<h2><strong>Disclaimer</strong></h2>
<p>The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by the authoring organizations.</p>
<p>&nbsp;</p>
</description>
<pubDate>Thu, 05 Nov 26 12:00:00 +0000</pubDate>
<dc:creator>CISA</dc:creator>
<guid isPermaLink="false">/node/25744</guid>
</item>
<item>
<title>CISA Adds One Known Exploited Vulnerability to Catalog</title>
<link>https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog</link>
<description><p>CISA has added one new vulnerability to its&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
<ul type="disc">
<li><a href="https://www.cve.org/CVERecord?id=CVE-2024-27834" target="_blank">CVE-2024-27834</a> Apple Multiple Products Improper Authentication Vulnerability</li>
</ul>
<p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.</p>
<p><a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk">Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk</a> establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.</p>
<p>While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">KEV Catalog vulnerabilities</a>. CISA will continue to add vulnerabilities to the catalog that meet the&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities">specified criteria</a>.</p>
<p>Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s&nbsp;<a href="https://cisasurvey.gov1.qualtrics.com/jfe/form/SV_1Zwu52kgK2OYf3w" target="_blank">KEV Nomination Form</a>. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.</p>
</description>
<pubDate>Wed, 04 Nov 26 12:00:00 +0000</pubDate>
<dc:creator>CISA</dc:creator>
<guid isPermaLink="false">/node/25749</guid>
</item>
<item>
<title>CISA Adds One Known Exploited Vulnerability to Catalog</title>
<link>https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog</link>
<description><p>CISA has added one new vulnerability to its&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p>
<ul type="disc">
<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-119977" target="_blank">CVE-2026-119977</a> WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability</li>
</ul>
<p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.</p>
<p><a href="https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk">Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk</a> establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.</p>
<p>While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">KEV Catalog vulnerabilities</a>. CISA will continue to add vulnerabilities to the catalog that meet the&nbsp;<a href="https://www.cisa.gov/known-exploited-vulnerabilities">specified criteria</a>.</p>
<p>Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s&nbsp;<a href="https://cisasurvey.gov1.qualtrics.com/jfe/form/SV_1Zwu52kgK2OYf3w" target="_blank">KEV Nomination Form</a>. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.</p>
</description>
<pubDate>Tue, 03 Nov 26 12:00:00 +0000</pubDate>
<dc:creator>CISA</dc:creator>
<guid isPermaLink="false">/node/25747</guid>
</item>
<item>
<title>Subnet Solutions PowerSYSTEM Center</title>
<link>https://www.cisa.gov/news-events/ics-advisories/icsa-26-307-01</link>
<description><p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-307-01.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources.</strong></p>
<p>The following versions of Subnet Solutions PowerSYSTEM Center are affected:</p>
<ul>
<li>PowerSYSTEM Center 2020 &lt;=5.29.x (CVE-2026-63017)</li>
<li>PowerSYSTEM Center 2024 &gt;=6.0.x|&lt;=6.2.x (CVE-2026-63017, CVE-2026-63774)</li>
<li>PowerSYSTEM Center 2026 &gt;=7.0.x|&lt;=7.1.x (CVE-2026-63017, CVE-2026-63774)</li>
</ul>
<div class="csaf-table">
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">CVSS</th>
<th role="columnheader">Vendor</th>
<th role="columnheader">Equipment</th>
</tr>
</thead>
<tbody>
<tr>
<td>v3 9</td>
<td>Subnet Solutions</td>
<td>PowerSYSTEM Center</td>
</tr>
</tbody>
</table>
<table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap>
<thead>
<tr>
<th role="columnheader" data-tablesaw-priority="persist">2 Vulnerabilities</th>
</tr>
</thead>
<tbody>
<tr>
<td>Incorrect Authorization, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')</td>
</tr>
</tbody>
</table>
</div>
<h3>Background</h3>
<ul>
<li><strong>Critical Infrastructure Sectors: </strong>Critical Manufacturing, Energy</li>
<li><strong>Countries/Areas Deployed: </strong>Worldwide</li>
<li><strong>Company Headquarters Location: </strong>Canada</li>
</ul>
<hr>
<h2>Vulnerabilities</h2>
<div class="icsa-etb-toggle-wrapper"><a class="icsa-etb-toggle-all" href="#">Expand All +</a></div>
<div class="c-expandable-textbox icsa-etb">
<div class="c-expandable-textbox__title">CVE-2026-63017</div>
<div class="c-expandable-textbox__body">Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.</div>
<div class="c-expandable-textbox-morebutton-wrapper"><a class="c-expandable-textbox-morebutton" href="#">Read More</a></div>
<div class="c-expandable-textbox__body2">
<h4>3 Affected Products</h4>
<hr>
<h5>Subnet Solutions PowerSYSTEM Center 2024 &gt;=6.0.x|&lt;=6.2.x</h5>
<div>
<p>Product Status: known_affected</p>
</div>
<h6>Remediations</h6>
<div>
<p><strong>Mitigation</strong><br>For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.</p>
</div>
<hr>
<h5>Subnet Solutions PowerSYSTEM Center 2020 &lt;=5.29.x</h5>
<div>
<p>Product Status: known_affected</p>
</div>
<h6>Remediations</h6>
<div>
<p><strong>Mitigation</strong><br>Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.</p>
</div>
<hr>The preview shows the first 200 lines. Download the raw payload for all of it.