Forum Discussion
Coordinated "cyberattack" on Minnesota water utilities: What you need to know
A coordinated cyber attack disrupted water and wastewater operations in more than 30 Minnesota communities on July 26-27, 2026; attribution remains pending a federal investigation. Four days prior, CISA and six federal agencies updated Advisory AA26-097A, documenting Iranian-affiliated exploitation of internet-connected PLCs across US water, energy, and government sectors. This FAQ addresses both.
CVE-2021-22681 is listed in CISA's Known Exploited Vulnerabilities catalog in connection with the activity documented in AA26-097A; the advisory does not name it by CVE ID, and it has not been confirmed as the vector for the Minnesota attacks, which remain under active federal investigation. CVE-2023-3595 and CVE-2024-6242 are included as platform hardening references for ControlLogix environments only.
| CVE | Description | CVSSv3 |
|---|---|---|
| CVE-2021-22681 | Rockwell Automation Studio 5000 Logix Designer / RSLogix 5000 Authentication Bypass Vulnerability | 9.8 |
| CVE-2023-3595 | Rockwell Automation ControlLogix 1756 Communication Module Remote Code Execution Vulnerability | 9.8 |
| CVE-2024-6242 | Rockwell Automation ControlLogix 1756 Trusted Slot Bypass Vulnerability | 8.4 |
CVE-2021-22681 is confirmed exploited in the AA26-097A campaign and has no available vendor patch. CVE-2023-3595 and CVE-2024-6242 are platform hardening reference for ControlLogix environments only.
For more information, including the availability of patches and Tenable product coverage, please visit our blog.
