BOD 26-04

US Government Agencies Warn of Cyber Attacks Targeting Industrial Refrigeration and Cold Chain Systems

The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, HHS, USDA, and DoT, has issued a joint fact sheet highlighting malicious cyber activity aimed at industrial refrigeration and cold chain monitoring systems worldwide. These systems are widely deployed across the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems sectors for temperature monitoring, logging, defrost management, and energy optimization. Attackers are exploiting vulnerabilities such as authentication bypass, arbitrary code injection, and weak configurations in unpatched or internet-exposed controllers. Successful exploitation allows threat actors to alter temperature settings, force continuous heating and defrost cycles, cause inventory loss, create fire hazards, and induce denial-of-view conditions. The advisory strongly recommends immediate implementation of mitigations aligned with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and NIST, including eliminating public internet exposure, isolating OT devices, enforcing strong authentication, applying patches, and maintaining offline backups.

CISA Adds SonicWall SonicOS CVE-2026-19868 to Known Exploited Vulnerabilities Catalog

CISA has added one new entry to its Known Exploited Vulnerabilities Catalog after confirming active exploitation in the wild. The vulnerability, tracked as CVE-2026-19868, affects SonicWall SonicOS SSLVPN and stems from the use of single-factor authentication. This flaw allows attackers to bypass stronger authentication controls and gain unauthorized access to VPN services. The addition triggers mandatory remediation timelines for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. CISA emphasizes that the vulnerability poses significant risks because successful exploitation can grant attackers full control over affected assets. Organizations outside the federal sector are strongly encouraged to adopt the same risk-based prioritization approach.