Review – 11 Advisories and 1 Update Published – 7-30-26

Today CISA’s NCCIC-ICS published 11 control system security advisories for products from MZ Automation (2), Watchfire, 06 Automation, Mitsubishi Electric, NASA, Rockwell Automation, Schneider Electric, Toptech, Johnson Controls, and MikroTik. They also updated an advisory for products from Hardy Barth. 

Advisories  

MZ Automation Advisory #1 - This advisory describes two vulnerabilities in the MZ Automation lib60870. 

MZ Automation Advisory #2 - This advisory describes eight vulnerabilities in the MZ Automation GmbH libiec61850. 

Watchfire Advisory - This advisory describes a hard-coded cryptographic key vulnerability in the Watchfire Controller Software. 

06 Automation Advisory - This advisory describes four vulnerabilities in the o6 Automation open62541 OPC UA stack. 

Mitsubishi Advisory - This advisory describes an improper enforcement of message integrity during transmission in a communication channel vulnerability in the Mitsubishi CC-Link IE TSN Communication Protocol. 

NASA Advisory - This advisory describes a NULL pointer dereference vulnerability in the NASA Core Flight System (cFS) Health & Safety (HS) Application. 

NOTE: This vulnerability is related to an incomplete fix for CVE 2026-15352. 

Rockwell Advisory - This advisory describes an improper check for certificate revocation vulnerability in the Rockwell CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module. 

Schneider Advisory - This advisory describes an out-of-bounds write vulnerability in the Schneider IGSS. 

Toptech Advisory - This advisory describes a missing authentication for critical function vulnerability in the Toptech Systems RCU II+ and Multiload II+. 

Johnson Controls Advisory - This advisory describes three vulnerabilities in the Johnson Controls OpenBlue Employee smart building ecosystem. 

MikroTik Advisory - This advisory describes an insufficient session expiration vulnerability in the MikroTik RouterOS. 

Updates  

Hardy Barth Update -  This update provides additional information on the Salia EV Charge Controller advisory that was originally published on April 21st, 2026. 

For more information on these advisories, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/11-advisories-and-1-update-published-68f  - subscription required. 

Review – S 4794 Introduced – Ag Cybersecurity Report

Last month, Sen Sheehy (R,MT) introduced S 4794, the Precision Agriculture Cybersecurity Act. The bill would require two different reports to Congress on cybersecurity in precision agriculture technologies. No new spending is authorized. 

Moving Forward  

While Sheehy is not a member of the Senate Agriculture, Nutrition, and Forestry Committee to which this bill was assigned for consideration, his sole cosponsor, Sen Schiff (D,CA) is a member. This means that there may be sufficient influence to see the bill considered by that Committee. Since this is a ‘report to Congress’ bill, I see nothing that would engender any organized opposition. I suspect that there would be significant bipartisan support for the bill if it were considered by the Committee.  

This bill is not politically important enough to be considered by the full Senate under regular order. It could possibly be considered under the unanimous consent process, but that process is fraught with potential opposition for unrelated political issues. The language from this bill could be added to a spending or authorization bill. 

For more information on the provisions of this bill, as well as suggestions for vulnerability disclosure language, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-4794-introduced-ag-cybersecurity - subscription required. 

Short Takes – 7-30-26 - Federal Register Editon

EPA  

Proposed Information Collection Request; Comment Request; Facility Ground-Water Monitoring Requirements, EPA ICR No. 0959.18, OMB Control No. 2050-0033. EPA 60-day ICR renewal notice. Summary: “Owners or operators that conduct ground-water monitoring are required to report information to the oversight agencies on releases of contaminants and to maintain records of ground-water monitoring data at their facilities. The goal of the ground-water monitoring program is to prevent and quickly detect releases of hazardous contaminants to groundwater, and to establish a program whereby any contamination is expeditiously cleaned up as necessary to protect human health and environment.” 

1,1,2-Trichloroethane Draft Risk Evaluation Under the Toxic Substances Control Act (TSCA); Notice of Availability and Request for Comment. EPA draft risk evaluation notice. Summary: “The Environmental Protection Agency (EPA or Agency) is announcing the availability of and seeking public comment on the draft risk evaluation under the Toxic Substances Control Act (TSCA) for 1,1,2-trichloroethane. The purpose of risk evaluations under TSCA is to determine whether a chemical substance presents an unreasonable risk of injury to health or the environment under the conditions of use (COUs), including unreasonable risk to potentially exposed or susceptible subpopulations identified as relevant to the risk evaluation by EPA, and without consideration of costs or non-risk factors. EPA is seeking comment on the draft risk evaluation for 1,1,2-trichloroethane.” 

Space Geek  

Waiver of Specified Statutory Requirements for Commercial Space Launch and Reentry Actions. FAA notice of proposed rulemaking. Summary: “FAA proposes to amend its commercial space licensing regulations to streamline the licensing process and reduce regulatory burden for applicants. Specifically, FAA proposes to invoke the Secretary of Transportation's statutory authority to waive requirements of laws of the U.S. for a license or permit, after consultation with the head of the appropriate executive agency, when the requirement is not necessary to protect the public health and safety, safety of property, and national security and foreign policy interests of the United States. FAA proposes waiving requirements under 13 laws for commercial space licenses and permits to operate a launch site, licenses to operate a reentry site, experimental permits, and licenses to operate a launch or reentry vehicle.” 

UAS 

Notice of Availability of the Final Programmatic Environmental Assessment and FONSI/ROD. FAA notice of availability. Summary: “The Federal Aviation Administration (FAA) announces the availability of the Final Programmatic Environmental Assessment (PEA) and Finding of No Significant Impact (FONSI)/Record of Decision (ROD), following the FAA's evaluation of the potential environmental effects of its decision related to unmanned aircraft systems (UAS) (drone) package delivery operations in the United States.” 

Executive Orders 

EO 14416 - Restoring Trust in the Smithsonian Institution – Federal Register. 

OMB Approves FCC Space Modernization Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule from the FCC on “Space Modernization for the 21st Century (SB Docket No. 25.306)”. The final rule was submitted to OIRA on July 27th, 2026. 

According to the 2026 Unified Agenda Entry for this rulemaking:  

“In this Notice of Proposed Rulemaking (Notice), the Federal Communications Commission (Commission) proposes to modernize the Commission’s space and earth station licensing process to allow space companies to more freely and successfully compete in the marketplace to serve the American people. In particular, the Notice proposes to develop a licensing assembly line” designed to route applications for efficient review based on specific aspects of a request. It further proposes to change the public notice timelines to allow for faster application processing; proposes reforms to bonds, processing rounds, license terms, and milestones; and substantially updates the earth station licensing regime.” 

With this quick (1 day turnaround) approval of the rulemaking, I would not be surprised to see this final rule published in the Federal Register this week. I do not expect to provide any detailed coverage of this final rule. Under my limited Space Geek coverage, I will at least mention its publication in the appropriate Short Takes post.