Published September 26, 2026 | Version 1.0.0 (2026 edition)
Report Open

State of OT Vulnerability Exposure in US Oil and Natural Gas, 2026

Authors/Creators

  • 1. Independent Researcher, Odessa, Texas, USA
  • 2. ROR icon Redeemer's University
  • 3. Computer Science and Engineering Department, University of Fairfax, USA
  • 4. Computer Science Department, University of Texas Permian Basin, Odessa, Texas, USA

Description

Annual report (2026 edition) measuring operational-technology vulnerability exposure disclosed in CISA ICS advisories relevant to the US oil and natural gas sector: advisory and CVE volume (with roll-up sensitivity), vendor concentration, severity, exploitation evidence (CISA KEV, CISA SSVC, FIRST EPSS) organised into exploitation-first priority tiers, weakness classes (CWE), remediation-signal coverage and ATT&CK for ICS overlap. Covers advisories published 1 January - 10 September 2026 against the same window in 2012-2025. Built reproducibly from the ONG-OT Vulnerability Prioritization Dataset v1.1 (doi:10.5281/zenodo.22729882); every number is generated from the pipeline's stats file. Limitations: see docs/LIMITATIONS.md in the repository.

Files

ong-ot-exposure-report-2026-v1.0.0-source.zip

Files (3.7 MB)

Name Size
md5:4ac175720f644a6895b981b13f6f64c7
2.4 MB Preview Download
md5:8c577d51f6d247e0e429a7ada8a82fd6
625.4 kB Download
md5:2865213a4848d8871d8e595681649f92
729.5 kB Preview Download

Additional details

Related works

Is derived from
Dataset: 10.5281/zenodo.22729882 (DOI)
Is supplemented by
Report: 10.5281/zenodo.22975133 (DOI)
Software: https://github.com/foikwuogu/ong-ot-exposure-report-2026 (URL)