UPDATE — water-sector PLC lockout status: an OT vendor's decade retrospective attributes the Minnesota controller intrusions to a CVE whose own record

UPDATE — water-sector PLC lockout status: an OT vendor's decade retrospective attributes the Minnesota controller intrusions to a CVE whose own record names a different Rockwell product family, and the campaign still has no CVE and no actor named by any investigating body

UPDATE · originally covered Water-sector PLC lockout status: the FBI has now named the targeted controller family — Rockwell MicroLogix 1100 and 1400 — while still declining to name an actor, and a 300,000-customer boil-water advisory in Georgia is the largest disclosed population impact so far (2026-08-09)

the prior weekly recorded the water-sector PLC lockout campaign in a state that had held since it began — a device family European operators could inventory, an operational effect on real utilities, and an attribution that no US authority would make. This week produced the campaign's first vendor attribution to a specific vulnerability, and it does not survive a check against that vulnerability's own record.

Dragos published a decade-spanning retrospective on 13 August setting the 2013 Bowman Dam intrusion against the July 2026 Minnesota campaign. Its description of the target is consistent with everything published before: "Attackers reached MicroLogix 1100 and 1400 series programmable logic controllers that were directly exposed to the internet through cellular links at water towers and lift stations." The new claim is the mechanism: "In Minnesota, it was dozens of PLCs reachable over cellular links, exploitable through a known authentication bypass vulnerability, (CVE-2021-22681) that was first disclosed in 2021 and added to CISA's Known Exploited Vulnerabilities catalog in March 2026, five years after initial disclosure" (Dragos, 2026-08-13). Half of that checks out: CISA added CVE-2021-22681 to the catalogue on 5 March 2026 (CISA Known Exploited Vulnerabilities catalog, 2026-08-16).

The product scope does not. CISA's own ICS advisory for that CVE is titled "Rockwell Automation Logix Controllers", and states that "Studio 5000 Logix Designer uses a key to verify Logix controllers are communicating with the affected Rockwell Automation products", with successful exploitation allowing "a remote unauthenticated attacker to bypass the verification mechanism and connect with Logix controllers". The products it lists as affected are RSLogix 5000 versions 16 through 20, Studio 5000 Logix Designer version 21 and later, and FactoryTalk Security version 2.10 and later (CISA ICS advisory ICSA-21-056-03, 2021-02-25). MicroLogix appears nowhere in it, and the flaw concerns a key used by Rockwell's Logix engineering software to verify Logix controllers — a different product line and a different mechanism from the MicroLogix 1100 and 1400 units Dragos names two paragraphs earlier. CISA's catalogue summary frames it the same way, around Studio 5000 Logix Designer and Logix controllers. The same advisory records a second divergence from Dragos's account that is worth stating given this entry's subject: Dragos gives the flaw a CVSS score of 9.8, while CISA's advisory reads "A CVSS v3 base score of 10.0 has been calculated". This entry carries CISA's 10.0, and notes that the advisory also records that Rockwell "has determined this vulnerability cannot be mitigated with a patch" — so a reader who took the retrospective's framing and went looking for a patch to apply would find none. What the FBI and EPA have published about Minnesota, and what this pipeline recorded from that reporting, describes no vulnerability at all: attackers reached internet-exposed controllers, changed their IP addresses and passwords, and locked operators out — reachability plus credential control.

Triage: unchanged from prior coverage, because the technique is unchanged. The observables for this campaign are administrative rather than exploit-shaped: a controller-mode or configuration change with no corresponding maintenance window, a management session to a field device originating from outside the engineering workstation subnet — particularly from the carrier-side of a cellular router rather than from the operator's own network — and credential or network-configuration changes on a controller that the engineering team cannot attribute to a change record. Legitimate remote maintenance produces the same protocol events, which is why origin and change-record correlation, not the event type, is what separates them.

Builds on: 2026-08-10/forescout-rockwell-plc-exposure-census-cellular-carrier-path