Cybersecurity Agency Sounds Alarm on Election Infrastructure Vulnerabilities
The US Cybersecurity and Infrastructure Security Agency (CISA) has published its 2026 Election Infrastructure Security Plan, warning that cyber threats to election systems are real and growing. The plan highlights structural barriers to patching vulnerabilities, the attractiveness of voter registration databases to foreign adversaries, and insider risks from staff, volunteers, and vendors.
At the heart of CISA’s concerns is the vulnerability management challenge facing election officials. Software used in elections can contain critical security flaws that need to be fixed promptly, but certification rules often slow down or even block patching efforts. This creates a cat-and-mouse game where malicious actors exploit vulnerabilities while vendors struggle to keep up with updates.
CISA notes that many state and local election offices lack basic cyber hygiene practices, such as regular vulnerability scans and penetration testing. Moreover, election infrastructure is often accessible from general enterprise networks, allowing attackers to move laterally if they gain a foothold in one area of the system.
To address these issues, CISA recommends aligning patch management with certification requirements, enabling real-time updates without affecting system certification. The agency also suggests paper ballots and manual post-election audits as additional security measures. Furthermore, CISA encourages software providers to assign CVE identifiers to flaws, provide timely vulnerability notifications, and share incident reports.
Voter registration databases remain a prime target for foreign adversaries, with hackers attempting to breach systems in all 50 states, with confirmed success in at least 20. To protect these databases, CISA prioritizes multi-factor authentication, network monitoring, access controls, log retention, and segmentation of public-facing tools from the master database.
Another significant concern is insider risk, which encompasses both malicious and careless actions by staff, volunteers, vendors, and contractors. Malicious insiders can make unauthorized changes to voter registration databases or ballot definitions, while careless ones may fall for phishing or mishandle equipment. CISA advises election offices to formalize bipartisan two-person ballot handling practices, counting observers, and chain-of-custody procedures into an insider threat program.
The plan also addresses physical risks, noting that 96 of the 107 election-related security incidents tracked since January 2022 were bomb threats. To mitigate this risk, CISA emphasizes the importance of secure communication channels and information-sharing platforms for election officials.
For the 2026 cycle, CISA is supporting a no-cost information-sharing platform for all fusion centers and state and local election officials, allowing near real-time communication with peers and federal partners. This model was successfully deployed during FIFA World Cup 2026. The plan also highlights free services available to election officials, including vulnerability scanning, continuous penetration testing, risk assessments, decoy systems, and canary tokens for detecting intrusions.
Ultimately, CISA’s Election Infrastructure Security Plan serves as a clarion call to election officials and software providers to prioritize cybersecurity and take proactive measures to protect the integrity of our electoral process.
Source: SecurityWeek — 2026-09-25