The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2021-26829, a medium-severity cross-site scripting (XSS) vulnerability in the open-source OpenPLC ScadaBR human-machine interface, to its Known Exploited Vulnerabilities (KEV) catalog following confirmed real-world abuse targeting industrial control systems. Although the flaw was patched in 2021 and affects older Windows and Linux versions of ScadaBR, it was recently exploited by pro-Russian hacktivist group TwoNet during attacks against ICS/OT honeypots designed to mimic water treatment facilities and operated by Forescout. In these incidents, attackers leveraged weak or default credentials to access the environment, created rogue user accounts, and exploited the XSS flaw to deface the HMI login page with scripted pop-up messages, while also disabling logs and alarms (demonstrating how low-skill adversaries can still disrupt operational technology environments using easily exploitable, legacy weaknesses). While the targeted systems were simulated and caused no real-world impact, the activity highlights ongoing hacktivist interest in the water sector and broader ICS infrastructure, as well as the risk posed by outdated interfaces and poor security hygiene. CISA has directed all U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate the vulnerability under Binding Operational Directive 22-01 by no later than December 19, 2025, and recommends that private organizations likewise review the KEV catalog to reduce exposure, warning that more sophisticated threat actors could quietly exploit similar flaws in targeted, undisclosed operations. CTIX analysts urge any affected administrators to ensure their infrastructure is patched in time.