Daily cybersecurity briefing — August 22, 2026: five concise items covering active PLC targeting, newly added exploited vulnerabilities, an OT component assurance initiative, CMMC readiness findings, and Microsoft cloud/identity patches.
U.S. agencies warn of active, AI-assisted targeting of Siemens S7 PLCs
NSA, CISA, FBI, DOE, and EPA issued a joint advisory describing an active cyber threat to Siemens S7 Series PLCs. The agencies report actors are using AI-generated exploitation scripts disguised as monitoring tools and Internet scanning to find exposed or insufficiently protected devices across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, and they recommend inventorying S7 devices, applying relevant patches, removing Internet exposure, strengthening access controls, and monitoring for anomalies.
Source: CISA
CISA adds actively exploited TrueConf Server flaws to its KEV catalog
CISA added two actively exploited TrueConf Server vulnerabilities, CVE-2026-72529 and CVE-2026-72530, to its Known Exploited Vulnerabilities catalog. The on‑premises server flaws can allow remote code execution for attackers with access to TCP port 4307 and were patched in TrueConf Server versions 5.3.9, 5.4.9, and 5.5.5; CISA set federal remediation deadlines and owners are advised to update, scan for indicators and malicious artifacts, and rotate potentially affected account credentials after an intrusion.
Source: SecurityWeek
ISASecure and NSA begin a high-criticality assurance path for commercial OT components
ISA announced ISASecure is partnering with the NSA to develop a High Criticality Component Security Assurance (HCSA) certification scheme for commercial OT components used in National Security Systems. The scheme builds on ISA/IEC 62443-4-2 security levels plus six NSA OT Assurance technical requirements, and an HCSA certificate is intended to provide manufacturers evidence for consideration on the NSA National Security Systems OT Product Compliant List to improve confidence in components used in high‑criticality environments.
Source: International Society of Automation
Defense contractors report a widening CMMC readiness confidence gap
Cybersecurity Dive reports CyberSheath’s 2026 State of the Defense Industrial Base found only two‑thirds of contractors that submitted CMMC self‑assessment scores were extremely or very confident those scores accurately reflected their posture. The median contractor placed readiness for a CMMC certification review at 70%, with one‑third saying they were at least 80% prepared and 1% fully ready; contractors cited ongoing struggles with changing requirements, evidence production for executive attestation, and demonstrating compliance in a survey of 302 defense contractors across IT, manufacturing, healthcare, and transportation.
Source: Cybersecurity Dive
Microsoft patches an exploited Entra ID flaw alongside critical cloud-service vulnerabilities
Microsoft released 22 security updates, including a server‑side fix for an exploited Entra ID remote‑code‑execution vulnerability tracked as CVE-2026-69836. Other fixes address critical and high‑severity flaws across Azure, Entra ID, Exchange, Fabric, Partner Center, Azure Arc, Azure Data Manager for Energy, and other services; most fixes were deployed server‑side, and Microsoft did not provide details about attacks exploiting the Entra ID issue.
Source: SecurityWeek
Operational priorities: inventory and isolate exposed ICS/OT assets, prioritize remediation of Known Exploited Vulnerabilities, apply available patches, remove unnecessary Internet exposure, rotate credentials after suspected compromise, monitor for anomalies, and review CMMC evidence readiness and supplier assurance developments.
