CISA Identifies Patching Barriers and Database Vulnerabilities in Election Security Plan

The US Cybersecurity and Infrastructure Security Agency (CISA) has released its 2026 Election Infrastructure Security Plan, warning that existing certification frameworks are preventing election officials from addressing software vulnerabilities promptly.

The plan, which was developed following a directive from Homeland Security Secretary Markwayne Mullin, outlines the cyber and physical threats facing election systems across more than 10,000 local jurisdictions. While state and local officials hold primary responsibility for infrastructure protection, CISA provides technical resources and information to support these efforts.

Certification Constraints Limit Patching

A significant finding in the report is that structural constraints within the certification ecosystem are limiting the ability of vendors to release and deploy security patches. In many cases, the rules governing how election software is certified can prevent system owners from applying updates quickly, as new software versions may require lengthy re-certification processes.

CISA recommended that patch management processes be aligned with certification requirements. This would allow security updates to be applied in real time without jeopardising the certified status of the system. The agency also encouraged software providers to issue a software bill of materials (SBOM) with every product and to assign Common Vulnerabilities and Exposures (CVE) identifiers to identified flaws.

Voter Registration Databases Under Threat

The agency’s assessment shows that voter registration databases remain a primary target for foreign adversaries. CISA noted that hackers have attempted to breach voter registration systems in all 50 US states, with confirmed successful breaches in at least 20 states over the last decade.

To mitigate these risks, CISA advised election officials to prioritise multi-factor authentication (MFA) and continuous network monitoring to detect anomalies. The plan also stresses the importance of keeping online registration and lookup tools used by the public walled off from master databases to prevent attackers from moving laterally through networks.

Insider Risks and Physical Security

The 2026 plan also identifies growing concerns regarding insider threats. These risks involve permanent staff, seasonal workers, contractors, and volunteer poll workers. CISA warned that malicious insiders could potentially make unauthorised changes to ballot definitions or tabulation settings, while less experienced personnel might inadvertently introduce risks through phishing or the use of unauthorised removable media.

To counter these threats, CISA recommended formalising documented insider threat programmes and maintaining bipartisan procedures, such as two-person ballot handling and strict chain-of-custody protocols.

Regarding physical security, the agency reported that bomb threats accounted for 96 of the 107 election-related security incidents tracked since January 2022. To assist with coordination, CISA is supporting a no-cost information-sharing platform for the 2026 election cycle, intended to facilitate near real-time communication between fusion centres and local election officials.