IC Technology & Surveillance — 2026-04-29

CISA Discloses Security Vulnerability in NSA GRASSMARLIN OT-Mapping Tool

CISA published ICS Advisory ICSA-26-118-01 on April 28 identifying a security vulnerability in GRASSMARLIN, an open-source operational technology network-mapping application originally developed by NSA. The tool is used to passively visualize and analyze industrial control system network topologies. No active exploitation has been reported, and the vulnerability affects analyst workstations running the tool rather than production control systems directly.

Analysis
The vulnerability exposes analyst workstations rather than production control systems, and exploitation demands both knowledge of active GRASSMARLIN deployments and privileged access, conditions that constrain opportunistic targeting. Per a single CISA ICS advisory, no active exploitation has been observed and no named actor has been identified as targeting the tool. A confirmed incident against OT networks within 90 days is unlikely given the niche install base. A competing risk is that adversaries already present in OT assessment environments use the advisory itself to locate and prioritize GRASSMARLIN deployments for follow-on collection rather than direct exploitation.

1 sources

ICS Advisory ICSA-26-118-01: NSA GRASSMARLIN - CISA