Annual report (2026 edition) measuring operational-technology vulnerability exposure disclosed in CISA ICS advisories relevant to the US oil and natural gas sector: advisory and CVE volume (with roll-up sensitivity), vendor concentration, severity, exploitation evidence (CISA KEV, CISA SSVC, FIRST EPSS) organised into exploitation-first priority tiers, weakness classes (CWE), remediation-signal coverage and ATT&CK for ICS overlap. Covers advisories published 1 January - 10 September 2026 against the same window in 2012-2025. Built reproducibly from the ONG-OT Vulnerability Prioritization Dataset v1.1 (doi:10.5281/zenodo.22729882); every number is generated from the pipeline's stats file. Limitations: see docs/LIMITATIONS.md in the repository.