The Cybersecurity and Infrastructure Security Agency (CISA) has published 

a major report 

(as of July 13, 2026) summarizing technical assessments of U.S. election software and networks conducted from 2019 to 2024. Together with newly declassified 2020 Intelligence Community assessments, the documents reveal ongoing challenges with software vulnerabilities, slow patching due to certification rules, and weak cybersecurity in many state, local, tribal, and territorial (SLTT) election environments.

Key Findings from the CISA Election Report:

  • CISA conducted direct software analysis (static/dynamic code review, fuzzing, crypto assessment), penetration testing/red team operations on SLTT networks, and incident response — all at the request of system owners/operators. Vulnerabilities were identified and reported to owners for mitigation in every case examined.
  • Election software contains typical complex-system flaws: input validation bugs, insecure deserialization, insufficient logging, race conditions, weak cryptographic implementations, and privilege escalation paths. Many issues were fixed by vendors before public release, but CISA could not always confirm that production deployments in the field included all fixes.
  • Major barriers to timely patching: Fragmented certification regimes (including EAC certification), pre-election “lockdown” periods mandated by some state laws, and limited SLTT IT budgets/staff prevent rapid updates. Legacy operating systems and third-party components (drivers, libraries) often remain unpatched for months or years. There is no secure auto-update mechanism for zero-day threats.
  • SLTT network weaknesses: Assessments repeatedly found flat or poorly segmented networks, weak identity and access management (poor MFA enforcement, shared credentials), insufficient logging/monitoring, legacy remote access paths, and co-location of election systems with general enterprise IT. In multiple penetration tests, CISA assessors gained full network control within hours or days — showing many environments remain soft targets even for moderately skilled adversaries.
  • Paper-based systems (now standard in most states) reduce some risks but are not immune (e.g., certain ballot marking devices with manipulable barcodes).

CISA Recommendations include:

  • Harmonize patch management and certification rules to allow real-time security updates without jeopardizing election eligibility.
  • Use human-readable paper ballots.
  • Conduct rigorous post-election manual audits of paper ballots.
  • Require vendors to assign CVEs, provide Software Bills of Materials (SBOMs), report incidents transparently, and notify customers of source code leaks.
  • Improve SLTT network segmentation, monitoring, and basic cyber hygiene.

From Declassified 2020 IC Assessments (NICM/NICA on election infrastructure vulnerabilities):

  • Foreign actors (Russia, China, Iran, and others) have the capability to target election infrastructure for data theft, disruption of reporting, or sowing public doubt — though large-scale manipulation of vote tabulation without detection is assessed as difficult due to paper trails and audits (required in 38+ states).
  • Cyber operations could delay results reporting or enable “man-in-the-middle” attacks on public-facing result websites, creating uncertainty even if certified tabulation results remain intact.
  • Adversaries could amplify risks by making false or exaggerated public claims of compromising voting machines/systems, which would be hard or impossible to fully disprove quickly and could erode confidence faster than actual technical impact.
  • Mitigations emphasized: physical/cyber hygiene best practices, third-party vendor screening, public education/messaging on the limited scope of low-impact operations, and private deterrence messaging to adversaries.

These releases highlight that U.S. election security depends on the interplay of software quality, certification processes, vendor transparency, and the cybersecurity maturity of SLTT networks. While no evidence of successful large-scale vote alteration appears in the documents, the identified vulnerabilities create real opportunities for disruption and disinformation. The reports stress transparency, paper records with manual audits, and systemic reforms as essential for maintaining public trust.

The documents were declassified under President Trump’s direction as part of ongoing government transparency initiatives.

Add as a preferred source on Google