OT Security Analysis: Exposed Devices Attacked in US Water Systems
Forescout Technologies GmbH – 5 August 2026
Key Findings
- Recent attacks against internet-facing controllers in U.S. water systems show that exposed operational technology remains a significant concern.
- There are 4,407 internet-facing controllers exposing port 44818 (EtherNet/IP).
- 65% are located in the U.S., followed by Canada (12%) and Spain (3%).
- Exposed controllers decreased 47% from a high of 7,814 devices in March 2020 to a low of 4,169 in June 2026.
- 70% of U.S.-based controllers are in large mobile network carrier networks, connected via cellular routers.
- The most common family is MicroLogix 1400 (50%), followed by CompactLogix 1769 (22%), MicroLogix 1100 (8%) and ControlLogix 5590 (8%).
- 22 hosts in this dataset were present in cities targeted in the current campaign.
- There is no confirmation of any CVE exploited in this campaign, but exposed controllers are often susceptible to known vulnerabilities.
- The most prevalent CVE observed in the 22 hosts in the affected cities was CVE-2017-16740. Exploitation would require Modbus TCP to be enabled, which was not confirmed.
- Beyond controllers, our research found expired certificates, unrenewed remote-access hostnames and abandoned servers that indicate incomplete asset visibility on municipal utilities.
- Disconnect PLCs from the public internet
- Disable unused services
- Implement secure remote access
- Plan to replace end-of-life devices