Exposed PLCs Are Still on the Internet: What CISA's Water Sector Alert Means for Attack Surface Management

On 30 July 2026, CISA published an alert warning of a significant increase in threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) sector. The advisory describes no software vulnerability with a CVE identifier. It describes an exposure problem: controllers reachable from the public internet, and the operational consequences when someone reaches them.

That distinction matters for anyone managing external attack surface. A CVE can be patched. An exposed industrial protocol service has to be found first, and finding it is a discovery problem before it is a remediation problem.

What the alert actually says

The alert records specific attacker behavior against exposed PLCs. According to CISA, threat actors have modified passwords to lock operators out of their own controllers and have disconnected PLCs by changing their IP addresses. The operational impact is not theoretical: the activity has resulted in boil water notices and sustained manual operations.

CISA states that the targeting covers water entities of all sizes, and that even organizations with mature cybersecurity processes should validate their external connections. The reason is a gap that asset inventories commonly miss. The activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.

The advisory lists the risk to internet-exposed OT assets as defacement, configuration changes, operational disruptions, and, in severe cases, physical damage.

For the Rockwell Automation MicroLogix 1400 specifically, CISA points operators to Rockwell Automation's notice on restoring access to a MicroLogix 1400 controller when the password is unknown.

Why this is an exposure problem, not a patching problem

The recommended mitigations in the alert are configuration and architecture changes rather than software updates:

• Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC.
• Enable password protection and change default passwords.
• Allowlist IPs so that remote access is permitted only from known engineering laptops or other critical OT assets.
• Keep a known clean backup of the PLC image, so that operators can recover if a modified password locks them out.

Every one of these steps assumes the organization already knows which controllers are reachable from the internet. The alert's own warning about undocumented cellular modems shows how easily that assumption fails. A modem installed by a vendor or integrator, absent from the asset register, will not appear in a scan that only covers the documented range.

This is where external attack surface data changes the workflow. Instead of asking whether the organization has exposed PLCs and waiting for an inventory reconciliation, an organization can query the internet-facing view directly and compare what is actually reachable against what the asset register claims.

What ZoomEye shows

To quantify how much industrial protocol exposure exists in the internet-facing view, we queried ZoomEye for the Modbus service, the industrial protocol most directly associated with the PLC exposure described in the alert. The queries ran on 15 September 2026 against the all scope, which covers both devices and websites/domains.

The selected Search query, service="modbus", matched 47,028 assets. That is the exposure figure for this article. The ZoomEye search link for the query is service="modbus".

Two results deserve comment. First, the Rockwell Automation MicroLogix fingerprint returned zero matches. That does not mean no MicroLogix controllers are exposed; it means ZoomEye's fingerprint set does not currently identify them under that name. We therefore make no product-specific exposure claim for the MicroLogix 1400, even though the alert names it. Second, the US-scoped queries matched 5,118 Modbus services and 4,745 assets on port 502. These are narrower views of the same exposure, and they are useful for an organization that wants to reason about its own jurisdiction or region.

Reading the numbers correctly

The counts above are matched totals from ZoomEye, not a count of compromised devices. An exposed Modbus service is a reachability finding. It says the service answered on the public internet at the time of the query. It does not say the device is running a vulnerable firmware version, that it is unpatched, or that anyone has accessed it.

CISA's alert describes confirmed attacker behavior against exposed PLCs. ZoomEye's data describes how many such services are visible. The two are related but not equivalent, and conflating them would overstate what the data shows.

There is also a scope limitation. The all scope includes both device assets and website/domain assets, so the totals reflect the broadest view rather than a device-only view. The counts are point-in-time observations at the timestamps shown; exposure changes as organizations disconnect controllers and as new ones come online.

Turning exposure data into action

The practical value of an external view is that it closes the gap the alert highlights. Three steps follow from the data:

First, compare. Query the industrial protocols in use across the organization's environment and compare the results against the asset register. Undocumented cellular modems and vendor-installed remote access paths are exactly the assets that this comparison surfaces.

Second, prioritize by reachability. A controller that answers on the public internet is a different risk category from one behind a VPN gateway. The alert's first mitigation, disconnecting the PLC from the internet, applies to the reachable set.

Third, verify after remediation. After disconnecting controllers or moving remote access behind a gateway, re-query the same protocols to confirm the exposure is gone. This turns the mitigation from a one-time change into a checkable outcome.

ZoomEye supports this workflow through its internet-wide asset index and its search syntax for industrial protocols, ports, and fingerprints. The ZoomEye search interface lets an analyst run the same query shown above and adjust it by country, organization, or protocol to match their own scope.

Limitations

This article relies on the CISA alert of 30 July 2026 for the description of attacker behavior and recommended mitigations, and on ZoomEye queries run on 15 September 2026 for exposure counts. The alert does not attribute the activity to a named threat group, and it does not list affected organizations. No CVE is associated with the alert, so no vulnerability-specific exposure claim is made here. The MicroLogix fingerprint returned zero and is reported as such rather than replaced with a vendor-wide query. Exposure counts describe internet-reachable services at a point in time, not confirmed compromise.

References

• CISA, "CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs," 30 July 2026. https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
• Rockwell Automation, "IMPORTANT NOTICE: Restoring Access to a MicroLogix 1400 Controller When the Password Is Unknown," referenced by the CISA alert.
• CISA, "Primary Mitigations to Reduce Cyber Threats to Operational Technology," referenced by the CISA alert.
• United Kingdom National Cyber Security Centre, "Secure Connectivity Principles for Operational Technology," referenced by the CISA alert.
• Federal Bureau of Investigation, "Malicious Cyber Actors Targeting Water and Wastewater Sector Internet Facing Programmable Logic Controllers, Causing Operational Disruptions," referenced by the CISA alert.
• ZoomEye, exposure queries executed 15 September 2026, all scope. Selected Search: service="modbus" (47,028). https://www.zoomeye.ai/searchResult?q=c2VydmljZT0ibW9kYnVzIg%3D%3D