CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand.
If you read nothing else
- Move admin and finance logins to phishing-resistant FIDO security keys. The biggest MFA bypass kit was taken down, and copycats remain.
- Patch firewall managers and remote access gateways now. A ransomware gang used one for weeks before a fix existed.
- If you build or host software, rotate the secrets your build pipelines can see.
Six things from March. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. The biggest MFA bypass phishing kit was taken down
On March 4, Microsoft and Europol, with partners, took down Tycoon 2FA, a phishing service that relayed logins and session cookies to get past multifactor authentication. Microsoft used a U.S. court order to seize 330 domains. Microsoft said the kit's messages reached more than 500,000 organizations a month. Source: CyberScoop, March 4.
What this means for you: a code or push approval can be relayed by a fake login page, so ordinary MFA is not the finish line.
Do this: move admin and finance accounts to FIDO security keys, and have your Microsoft 365 admin alert on sign-ins from new devices.
2. A ransomware gang used a Cisco firewall flaw before the fix
The Interlock ransomware group exploited CVE-2026-20131, a flaw in Cisco Secure Firewall Management Center rated 10.0, from late January, 36 days before it was disclosed, according to Amazon's research. Source: Security Affairs. CISA added it to its exploited list on March 19 and marked it as used in ransomware campaigns. Source: CISA KEV catalog.
What this means for you: the system that manages your firewalls can be the first thing an attacker owns.
Do this: if you or your provider use Cisco firewall management, confirm the March fix is installed and that its logs were checked back to January.
3. Citrix NetScaler gateways needed an urgent patch
CISA added CVE-2026-3055, a NetScaler ADC and Gateway flaw, to its exploited list on March 30, with an April 2 deadline for federal agencies. Source: CISA KEV catalog. NVD describes it as insufficient input validation that leaks memory when the appliance is set up as a SAML identity provider. Source: NVD record.
What this means for you: the box your staff use to log in from home sits on the internet and gets attacked first.
Do this: ask your IT provider whether you run NetScaler and, if so, the date it was patched.
4. A security scanner was turned into a password thief
On March 19, attackers used stolen credentials to publish a malicious release of Trivy, a widely used open source security scanner, and its GitHub Actions, which stole secrets from build systems. Source: Wiz. CISA added it to its exploited list as CVE-2026-33634 on March 26. Source: CISA KEV catalog.
What this means for you: the tools that check your code for problems run with the keys to your systems.
Do this: if your developers or vendors use Trivy in their build pipelines, have them rotate every secret those pipelines could see.
5. AI workflow tools were attacked over the internet
CISA added Langflow CVE-2026-33017, a code injection flaw, to its exploited list on March 25, and n8n CVE-2025-68613 on March 11. Both are tools for building AI and automation workflows. Source: CISA KEV catalog. NVD says the Langflow flaw let anyone build public flows without logging in. Source: NVD record.
What this means for you: a quick AI experiment left on the internet is a server someone else can run code on.
Do this: list every AI or automation tool your team has set up, and take any that do not need to be public off the internet.
6. CMMC Phase 2 was still on the calendar
At the end of March, Phase 2 of CMMC was scheduled to take effect on November 10, 2026. On July 13, 2026, the Department of War suspended it pending a 60 day review. Source: WilmerHale client alert.
What this means for you: Level 1 and Level 2 self-assessments, SPRS and NIST SP 800-171 applied then and still do.
Do this: check that your SPRS score matches your current System Security Plan.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.