CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks
Source SecurityWeek
Description
The US Cybersecurity and Infrastructure Security Agency (CISA) released its 2026 Election Infrastructure Security Plan highlighting challenges in patching election software due to certification constraints, vulnerabilities in voter registration databases, and insider risks. The plan emphasizes that outdated certification regimes limit timely patching, and many state and local election offices struggle with basic cybersecurity hygiene. Voter registration databases have been targeted successfully in at least 20 states. Insider threats from staff, volunteers, and vendors pose risks to election integrity. Physical threats, such as bomb threats, remain prevalent. CISA recommends aligning patch management with certification, using paper ballots and audits, and enhancing insider threat programs. The agency also offers free cybersecurity services and an information-sharing platform for election officials.