CISA released the 2026 Election Infrastructure Security Plan on 24 September, ahead of the November 2026 midterms, setting out guidance and resources for state, local, tribal and federal bodies on mitigating cyber and physical threats to election infrastructure. The plan covers both physical assets — storage facilities, polling places and centralised vote tabulation locations — and the information and communications technology layer, including voter registration databases, voting machines and the systems that manage and report results, with CISA framing election infrastructure as a target for actors seeking to manipulate systems or steal sensitive data. The document's publication sits inside a fortnight in which the same agency added three actively exploited flaws to its Known Exploited Vulnerabilities catalog with unusual deadlines — SharePoint and MikroTik on a three-day window closing 28 September — a reminder that the election-security guidance lands on the same estates that carry the unpatched enterprise software. For non-US readers the transferable element is the framing rather than the deadline: election integrity depends on the security posture of systems that are not election-specific, including mail servers, content management systems and identity infrastructure.

• Source article