Election Security Before the 2026 Midterms: What CISA and EAC Say

On 24 September 2026 CISA published its 2026 Election Infrastructure Security Plan, titled "Securing the Next 250," ahead of the 3 November midterm elections. Read alongside an Election Assistance Commission (EAC) report from May and a threat study from June, it gives a fairly clear view of where election IT is weak and where it is strong.

None of these sources predicts a failed election. They describe weak points and recommend fixes.

What the sources say

CISA's plan. The plan says more than 10,000 local jurisdictions run elections day to day, and that state and local officials hold primary responsibility for protecting the infrastructure. CISA names three factors that shape security: software vulnerability management limited by outdated certification regimes, inconsistent transparency from vendors about vulnerabilities and patches, and the cybersecurity immaturity of many state and local networks that host election systems.

It notes that election systems are often reachable from general enterprise networks, which gives attackers room for lateral movement after a phishing compromise. Its mitigations include paper ballots that can be reviewed, post election manual audits of those ballots before certification, and asking vendors to assign CVE numbers, report incidents and provide an SBOM with delivered products.

On voter registration databases, the plan says attackers have attempted to breach systems in all 50 states, with confirmed success in at least 20. It recommends multi factor authentication for all administrative and remote access, least privilege, logging retained for at least one year, and separating public lookup services from the master database.

Physical and insider risk. CISA reports 107 election related incidents tracked in open source between 1 January 2022 and the plan's date. Of those, 96 were bomb threats. It also calls insider risk a structural feature, because elections rely on large numbers of temporary workers. It points to long standing practices such as bipartisan teams of two and chain of custody.

EAC, May 2026. The EAC's report on VVSG 2.0 (the federal voting system guidelines adopted in February 2021) says two systems have been certified to the new standard so far, one in July 2025 and one in November 2025. It estimates the average age of voting equipment will be about 9.3 years by 2028 if not replaced, and that replacing all equipment in 2028 would cost roughly $2.71 billion.

Check Point, 1 June 2026. Reported by Nextgov, the study found attackers more likely to go after campaign accounts, fundraising platforms, public websites and local governments than voting machines. It also found about 9,500 credentials linked to ActBlue and 6,500 linked to WinRed exposed, though not through breaches of those platforms. Check Point itself cautions that newly registered domains with election related words do not prove malicious use.

Evidence and debate

Documented: the CISA findings, the EAC numbers, the age of equipment, the spread of attempted intrusions into registration databases.

Debated: CISA's capacity. Infosecurity Magazine reports that critics point to 2025 cuts at the agency and the end of federally funded support for the Election Infrastructure ISAC, which the plan does not mention. A letter on 3 September 2026 from Senator Alex Padilla and Representative Joe Morelle asked for that funding to be restored. We have not verified the budget figures behind the criticism.

Speculation: claims about how much AI will scale influence operations. Nextgov notes these describe expectations, not observed outcomes.

What to do now

If you run or support an election office, or any small public body:

1. Put multi factor authentication, phishing resistant where possible, on every administrative account.
2. Segment election systems from the general office network.
3. Request CISA's no cost services: vulnerability scanning, exercises and regional advisors.
4. Ask each vendor for patch status and an SBOM.
5. Keep paper records and rehearse the audit process.

If you are a citizen or a company employee, the useful step is smaller: use official state or county sites for results, and treat unofficial charts with the same caution as any headline.

Quick check

Sources

• CISA: 2026 Election Infrastructure Security Plan, 24 September 2026
• CISA plan PDF
• EAC: The Road to Widespread Deployment of VVSG 2.0 Certified Voting Systems, May 2026
• Nextgov: Hackers are already laying groundwork to disrupt the 2026 midterms, research says, 1 June 2026
• Infosecurity Magazine: CISA unveils election security plan ahead of 2026 midterms