CISA Saw This Coming Four Days Early. Thirty-Six Systems Still Fell.

TITLE: CISA Saw This Coming Four Days Early. Thirty-Six Systems Still Fell. BODY:

Monday morning in Braham, Minnesota, population 1,700, a public works crew showed up to find their water plant dark. Someone had reached through the internet, found the wireless connection to the city's well and treatment facility, and turned it off. It took roughly 90 minutes to restore manual control. By then, 35 other Minnesota water systems had the same problem.

The attack is being framed as proof Iran is escalating cyber operations against U.S. utilities. That is true but it is not the story. The story is the four-day gap.

The Warning That Did Not Stop Anything

CISA updated its advisory on Iran-linked attackers targeting programmable logic controllers on July 22 — four days before the attacks hit Minnesota. That update expanded the scope to include Schneider Electric and Siemens devices, documented project file exfiltration for the first time, and added detection guidance. The advisory named the sector, named the hardware, named the adversary pattern. The attacks came anyway.

Translation: CISA knew what was being targeted, updated the warning to say it was getting worse, and 36 utilities still could not act in time.

Two explanations fit. Either the advisory was too vague to operationalize in 96 hours, or water utilities lack the staff and budget to implement emergency OT mitigations on that clock. The evidence points to both being true.

CyberAv3ngers targets small water and municipal facilities, which experts consider among the lowest-hanging fruit in U.S. critical infrastructure. Many small and rural facilities lack dedicated cybersecurity resources. In Braham, the attack disabled computerized controls and shut down the well and treatment plant. Public works crews restored it within two hours. Two hours of manual scramble in a town that cannot afford a full-time cybersecurity professional is the control test for the entire early-warning system.

The Vulnerability Nobody Can Patch

The technical spine of this attack has been public since 2021. CVE-2021-22681 is a critical authentication bypass in Rockwell Automation Logix controllers with no available vendor patch. CISA added it to its Known Exploited Vulnerabilities catalog in March 2026 following confirmed Iranian exploitation. The CVSS score is 9.8. The flaw involves an insufficiently protected cryptographic key, allowing unauthenticated attackers to impersonate Rockwell engineering software and modify PLC logic.

Water treatment plants cannot take industrial controllers offline without disrupting services that must run continuously. The result is a permanent gap: a critical, known vulnerability sitting exposed in infrastructure that cannot safely be updated. Rockwell confirmed there is no patch coming. The design issue must be addressed through network segmentation, secure remote access, CIP Security, and physical mode switch hardening — all of which require time, budget, and OT expertise most small utilities do not have.

This is not a patching story. It is a structural story.

Approximately 5,219 internet-exposed Rockwell hosts were identified globally as of April 2026, with the United States accounting for 3,891. The attackers did not need a zero-day. They needed a list.

What the Attribution Actually Tells You

U.S. intelligence agencies assessed that Iran likely orchestrated the attack on more than 30 municipal water systems. That assessment is preliminary. No U.S. government agency has issued formal attribution tying the Minnesota incident to that campaign — officials described the responsible party only as "unknown actors."

Formal attribution matters for the diplomatic response. It matters less for your threat model.

CyberAv3ngers' techniques have proliferated to more than 60 affiliated hacktivist groups coordinated through an "Electronic Operations Room." Whether the Minnesota actors were IRGC-CEC or a less disciplined affiliate running the same playbook, the exploit vector is now widely distributed. Whoever did this, more people know how.

Federal authorities reported loss of monitoring and control functionality at critical infrastructure sites in at least seven states, leading to pressure loss and flooding. Not 36 utilities. Seven states.

What to Watch

The post-incident review of CISA Advisory AA26-097A will show whether the agency acknowledges the July 22 update reached asset owners in a form actionable enough to prevent what it warned about. If not, the advisory system has a credibility problem.

Watch for EPA enforcement action or new mandatory OT segmentation standards. "Urgently review" the advisory for activity on your networks. After this week, the pressure for a mandate just increased.

And watch the 30-to-60-day window on electrical, gas, and wastewater systems for intrusion attempts using the same Rockwell authentication bypass. The playbook is proven. The exposure is documented. The patch does not exist.