Review – 6 Advisories and 2 Updates Published – 9-1-26

Today CISA’s NCCIC-ICS published six control system security advisories for products from Rockwell Automation. They also updated two advisories for products from Rockwell and Mitsubishi. 

Advisories  

Rockwell Advisory #1 - This advisory describes two vulnerabilities in the Rockwell Historian ME. The vulnerabilities were self-reported. 

Rockwell Advisory #2 - This advisory discusses an infinite loop vulnerability in the Rockwell ControlLogix, CompactLogix, and GuardLogix product lines. This is a third-party vulnerability. 

Rockwell Advisory #3 - This advisory describes an improper restriction of excessive authentication attempts vulnerability in the Rockwell FactoryTalk Activation Manager. The vulnerability was reported to Rockwell by an anonymous researcher. 

Rockwell Advisory #4 - This advisory describes an improper restriction of operations within the bounds of a memory buffer vulnerability in the Rockwell Logix Platform. The vulnerability was self-reported. 

Rockwell Advisory #5 - This advisory describes two incorrect default conditions vulnerabilities in the Rockwell Redundancy Module Configuration Tool. The vulnerability was self-reported. 

Rockwell Advisory #6 - This advisory describes four vulnerabilities in the Rockwell RSLinx Classic. The vulnerabilities were self-reported. 

Updates 

Rockwell Update - This update provides additional information on the 1734 POINT I/O advisory that was originally published on July 21st, 2026. The new information includes updating impact statement and CVSS scores. 

Mitsubishi Update - This update provides additional information on the Multiple FA Engineering Software Products advisory that was originally published on May 14th, 2024, and most recently updated on June 9th, 2026. The new information includes updating GENESIS64 and ICONICS Suite affected and fixed versions. 

For more information on these advisories, as well as a DTRH look at a Rockwell exploit and 3 other Rockwell advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/6-advisories-and-2-updates-published-24b - subscription required. 

House Passes HR 5174 – Technical Update to 51 USC

Yesterday, the House took up HR 5147, the revision of Title 51, United States Code, National and Commercial Space Programs, under the suspension of the rules process. After 21 minutes of debate, the bill was passed by a voice vote. The bill revises 51 USC to keep the Title current and make technical corrections to improve the USC.  

Subsection 2(b) explains the scope of the changes being made:  

“The restatement of existing law enacted by this Act does not change the meaning or effect of the existing law. The restatement incorporates in title 51, United States Code, various provisions that were enacted separately over a period of years, reorganizing them, conforming style and terminology, modernizing obsolete language, and correcting drafting errors. These changes serve to remove ambiguities, contradictions, and other imperfections, but they do not change the meaning or effect of the existing law or impair the precedential value of earlier judicial decisions or other interpretations.” 

The bill will most likely be handled similarly in the Senate, where it would be considered under the unanimous consent process. However, a similar bill, HR 7339, was introduced and similarly passed in the House in December of 2024, but no action was taken in the Senate. 

Short Takes – 9-1-26 - Federal Register Edition

NEPA  

National Environmental Policy Act Regulations. DOT/FHWA/FRA/FTA final rule. Summary: “FHWA, FRA, and FTA (collectively referred to as the “Agencies”) are finalizing the interim final rule (IFR) published on July 3, 2025, which revised the Agencies' National Environmental Policy Act (NEPA) of 1969 implementing regulations in light of the removal of the Council on Environmental Quality (CEQ) regulations, the amendments to NEPA included in the section of the Fiscal Responsibility Act (FR Act) of 2023, known as the Building United States Infrastructure through Limited Delays and Efficient Reviews (BUILDER) Act of 2023, amendments regarding efficient environmental reviews included in the Infrastructure Investment and Jobs Act (IIJA) of 2021, and the Supreme Court decision in Seven County Infrastructure Coalition. The Agencies provided a 30-day comment period for the public to review and comment on the IFR. This final rule addresses public comments received and finalizes the IFR with minor technical changes.” 

Pipeline Safety  

Pipeline Safety: Joint Meeting of the Gas and Liquid Pipeline Advisory Committees. PHMSA comment period extension. Summary: “On July 17, 2026, PHMSA published a Federal Register notice titled: “Pipeline Safety: Joint Meeting of the Gas and Liquid Pipeline Advisory Committees,” which provided an opportunity for public comment by August 31, 2026, on the proceedings of the Gas and Liquid Pipeline Advisory Committees meeting related to 13 notices of proposed rulemakings (NPRM). These proposed rules covered topics such as special permit conditions, in-plant piping, incidental gathering lines, coating damage assessments, atmospheric corrosion, class change pressure tests, maximum allowable operating pressure reconfirmation, operator identification notifications, limitations on welding, remote valves, the property damage definition, right-of-way patrols, and reporting deadlines. PHMSA received requests from stakeholders to extend the comment period. Based on those requests, PHMSA is reopening the comment period for the joint Pipeline Advisory Committee (PAC) proceedings related to the 13 regulatory modernizing NPRMs to September 4, 2026.” 

Surface Transportation Security  

Revision of Agency Information Collection Activity Under OMB Review: Cybersecurity Measures for Surface Modes. 30-day ICR revision notice. Summary: “The ICR describes the nature of the information collection and its expected burden. The collection involves the designation of a Cybersecurity Coordinator; the reporting of cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency; the development of a cybersecurity contingency/recovery plan to address cybersecurity gaps; and the completion of a cybersecurity assessment.” 

NOTE: Today’s notice reports that “After publishing the 60-day notice (link added), TSA reviewed and updated the number of respondents from 846 to 67 and updated the estimate of the annual time burden from 210,684 hours to 22,167 hours.” I will be taking a detailed look at the changes once TSA submits their data to OIRA. 

Review – Bills Introduced – 8-31-26

Yesterday with just the House in Washington (Senate’s summer vacation runs another two weeks) there were 24 bills introduced. One of those bills will receive additional coverage in this blog: 

• HR 10197 To improve the security of nucleic acid synthesis in interstate and foreign commerce, and for other purposes. Rep. Pfluger, August [R-TX-11]    

For more information on these bills, including legislative history for similar bills in the 118th Congress as well as a mention-in-passing of a new whistleblower protection bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-8-31-26 - subscription required. 

HR 7945 Markup Scheduled – Nitrous Oxide Safety Act

The Subcommittee on Commerce, Manufacturing, and Trade of the House Energy and Commerce Committee is scheduled to hold a business meeting today that will look at 12 bills, including HR 7945, the Nitrous Oxide Safety Act of 2026. That bill would establish that, with certain specified exceptions, a consumer product containing nitrous oxide (NO2) is a banned hazardous product under 15 USC 2057. No new funding is authorized. 

According to a Committee Staff memorandum published last Friday: 

“This bill prohibits any consumer product that contains nitrous oxide under section 8 of the Consumer Product Safety Act. The bill contains exceptions for certain products used in the course of medical or dental treatment and research and development.” 

That description overlooks the provisions of §2(b)(1)(B) which also excepts “commercial production of food or food products, including in a manufacturing setting or commercial kitchen”. Unfortunately, there is no mention in the bill of the use of nitrous oxide as a horsepower enhancer for internal combustion engines.