Resilience this week: exploited edge systems, CNI threats and electricity restoration
29 September 2026 | AV Resilience Consulting
Three developments from 22-28 September show why cyber response, physical security and service restoration need to be planned together.
Actively exploited Citrix vulnerabilities. On 28 September, the UK's National Cyber Security Centre (NCSC) warned organisations to promptly mitigate vulnerabilities in on-premises Citrix NetScaler ADC and Gateway. It said two, CVE-2026-88771 and CVE-2026-88772, are being actively exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both to its Known Exploited Vulnerabilities catalogue. NCSC advises affected organisations to read the vendor bulletin and indicators of compromise, consider isolation where possible, investigate for compromise, update and keep monitoring. Isolation can interrupt service, so response teams should coordinate security action with continuity and recovery plans rather than treating patching as a purely technical change.
Government briefings for critical infrastructure. On 25 September, the Cabinet Office and Ministry of Defence announced plans for closed-door briefings with industry bodies representing Critical National Infrastructure (CNI) providers and defence companies on threats posed by Russia. The announcement names cyber attacks and sabotage among the risks. This is an announcement of planned briefings, not a claim that a specific new incident has affected an operator.
Learning from electricity restoration. On 25 September, the National Energy System Operator (NESO) described an exchange with Portugal's transmission operator REN on system resilience, severe weather, restoration planning and the challenges of the energy transition. This is a useful example of operators testing assumptions against real operational experience; NESO did not announce a change in the UK restoration standard.
AV Resilience interpretation: The common test is whether an organisation can protect its essential service while it contains a threat, loses a dependency or restores a complex system. Boards and response teams should know which externally exposed systems and suppliers support their important services, who can authorise emergency isolation, what manual or alternative capacity exists, and how restoration will be rehearsed with operators and partners. For energy organisations, that means linking cyber incident playbooks to operational technology, control-room and system-restoration arrangements rather than keeping each plan in a separate silo.
On the policy radar: Ofgem opened a call for input on gas connections and access arrangements on 24 September (responses due 21 October), and consultations on electricity connections data and the connections experience on 25 September (responses due 6 November). They are proposals and evidence-gathering, not final rules.
