I keep a close eye on CISA's advisory feed, partly out of habit and partly because it's one of the best early-warning systems we have. Most weeks it's routine. This past week it wasn't. CISA added a Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog - meaning there's confirmed evidence attackers are already using it in the wild - and, in the same stretch of days, published a noticeable pile-up of advisories for building-automation and energy-sector equipment. Those two developments point to the same exposure that keeps me up at night when I think about our clients in healthcare, finance, manufacturing, and government contracting: the stuff sitting at the edge of the network, and the systems running your building, that nobody re-evaluates once they're installed.
Citrix NetScaler appliances (formerly branded ADC/Gateway) are the kind of device almost every mid-sized organization has somewhere - handling VPN connections, remote access, or load balancing for a line-of-business application. They sit directly on the internet by design, which is exactly why they're such an attractive target. This is not a new pattern. NetScaler and similar VPN-gateway products have been tied to major ransomware incidents against hospitals and other organizations in past years, because a single flaw in one of these appliances can hand an attacker a foothold inside the network before anyone even opens a phishing email. The vulnerability added to CISA's catalog this week is the latest reminder that this product category stays squarely in attackers' crosshairs, and that "it's just our firewall/VPN box, it's been fine for years" is not a risk assessment.
What makes this relevant for compliance-bound businesses is how these advisories are increasingly woven into the rules you're already supposed to follow. CISA's Known Exploited Vulnerabilities catalog is explicitly referenced in federal vulnerability-management requirements. Auditors for frameworks like NIST 800-171 (government contractors), HIPAA's Security Rule risk analysis (healthcare), and financial-sector exam guidance are increasingly asking a very direct question: do you track CISA's KEV catalog, and how fast do you patch when something your business relies on shows up on it? If your honest answer is "we didn't know to check," that's a gap worth closing before someone else points it out for you. That compliance question leads directly to the systems most people overlook: the equipment tied to your building.
The second thread is less obvious but just as important. Alongside the NetScaler alert, CISA also published a run of advisories covering industrial and building-automation equipment - including controllers used to manage HVAC, electrical distribution, and facility operations in commercial buildings, plus asset-management and substation software used across the energy sector. It's easy to read "critical infrastructure" advisories and assume they only apply to power utilities and pipelines. They don't. The same category of building-automation controller named in these advisories shows up in hospitals, manufacturing plants, data centers, and office buildings everywhere - including, quite possibly, the one your business operates out of. And that makes the next issue harder to ignore: these systems are often managed outside IT.
Here's the uncomfortable part: mechanical or facilities contractors usually install and manage these systems, not your IT team, and they rarely show up on anyone's cybersecurity radar. They get connected to the network for remote monitoring, given a static IP years ago, and then forgotten - right up until a vulnerability affecting that exact controller model gets published. For a hospital, a compromised building-automation system can mean operational disruption that bleeds into patient care. For a manufacturer, it can mean a halted production line. For a government contractor, it can mean an OT asset nobody disclosed sitting inside a network boundary that should have been fully documented.
Every business should care about patching internet-facing gateways and knowing what's on its network. But the stakes compound quickly once compliance obligations are layered on top. A breach that starts at a VPN appliance and touches protected health information triggers HIPAA breach-notification obligations and OCR scrutiny. A compromised building system at a defense contractor's facility raises uncomfortable questions during a CMMC assessment about asset inventory and system boundaries. A financial-services firm that gets flagged for an unpatched, publicly known exploited vulnerability during an exam isn't just fixing a technical problem anymore - it's explaining a governance failure to a regulator. Technology risk and compliance risk are the same risk; they just get reported to different people.
Inventory your internet-facing edge devices. VPN gateways, firewalls, remote-access appliances - know exactly what you have, what firmware version it's running, and who owns patching it.
Check your exposure against CISA's KEV catalog on a schedule, not by accident. Build a recurring process - weekly is reasonable for a small business - to cross-reference what you run against newly added entries, and document that you did it. Auditors care about the paper trail almost as much as the patch.
Ask who manages your building-automation and facilities systems. If the answer is "the HVAC vendor handles that," and nobody in IT knows what's on that network segment, that's your next project. These systems deserve the same segmentation and monitoring as any other networked asset.
Separate OT and IT networks wherever possible. A building controller or industrial system should never share a flat network with your email servers and workstations. Segmentation limits how far a single compromised device can reach.
Get it in writing from your vendors. Whether it's a software vendor, a facilities contractor, or an MSP, ask how they track exploited vulnerabilities in the products they install for you, and how quickly they act once something is flagged.
Lumos Technology Services works with healthcare practices, financial firms, manufacturers, and government contractors across North Texas to close exactly these kinds of gaps - KEV-driven patch management, network segmentation between IT and OT/building systems, and documentation that holds up when an auditor or examiner comes asking. If you're not sure what's sitting on your network edge, or who's responsible for the building systems connected to it, let's find out together before it becomes someone else's finding.
Note: The vulnerability and advisory details referenced above are drawn from CISA's public Known Exploited Vulnerabilities catalog and ICS advisory feed published in early October 2026, and reflect well-documented, publicly reported information as of this post's publish date. We encourage readers to consult CISA's advisories directly for the latest updates and remediation guidance.
Banner photo: "CERN Computer Center 02" by SimonWaldherr, via Wikimedia Commons, licensed under CC BY-SA 4.0.