Critical 9.8
KEV-listed
CVE-2021-22681
Iranian-affiliated CyberAv3ngers exploit CVE-2021-22681 to attack Minnesota water utilities
Vendor / product: Rockwell Automation Logix controllers, Schneider Electric PLCs, Siemens PLCs
Event date: 2026-07-26
Victim organization: Minnesota water utilities
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2026-03-26 (178 days overdue)
Ransomware campaign use
Unknown
CISA description
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
CyberAv3ngers
Sources & citations (155)
- Minnesota Water Cyber Attack and CISA Advisory AA26-097A tenable.com · 2026-07-29
- Minnesota Water Systems Hit by Cyberattack, More Than 30 Municipalities Affected us.headtopics.com · 2026-07-30
- 2 New Jersey municipal water systems targeted in cyberattacks yahoo.com · 2026-08-05
- Coordinated 'cyberattack' on Minnesota water utilities: What you need to know securityboulevard.com · 2026-07-29
- Iranian Hackers Exploited Unpatchable PLC Flaw to Breach 30 Minnesota Water Systems techtimes.com · 2026-07-29
- IRANIAN-LINKED PLC EXPLOITATION AND THE MINNESOTA WATER-SECTOR CYBERATTACK cyberwarrior76.substack.com · 2026-07-29
- Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline thehackernews.com · 2026-07-29
- Hackers Disrupt Controls at Minnesota Water Utilities bankinfosecurity.com · 2026-07-29
- Authorities investigating a coordinated cyberattack against Minnesota water systems cybersecuritydive.com · 2026-07-28
- ‘Coordinated Cyberattack' Hits More Than 30 Minnesota Water Systems theepochtimes.com · 2026-07-29
- Iranian hackers suspected of attacking 30 Minnesota water companies cryptonews.net · 2026-07-29
- Minnesota Water Systems Targeted in 'Coordinated Cyberattack' as FBI Joins Race To Contain Damage ibtimes.co.uk · 2026-07-29
- Hackers Strike Minnesota Water Utilities, One Plant Briefly Offline securityaffairs.com · 2026-07-29
- Hackers target over 30 Minnesota water utilities in coordinated OT attack bleepingcomputer.com · 2026-07-29
- Hackers hit more than 30 water utilities this week - was it Iran? techlicious.com · 2026-07-29
- Minnesota Water Systems Hit in Coordinated Strike: Iranian-Linked Group Suspected webpronews.com · 2026-07-29
- Cyberattack hits more than 30 water utilities across Minnesota miamiherald.com · 2026-07-28
- Cyberattacks highlight risks to Minnesota drinking water from aging IT systems minnpost.com · 2026-07-28
- Minnesota Water Cyberattack Hits 30 Systems, Tap Water Safe gadgetsnow.indiatimes.com · 2026-07-29
- Coordinated Cyberattack Targets Minnesota Water Systems my.headtopics.com · 2026-07-29
+135 more sources
References
See CVE-2021-22681 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →