type: incident · created: 2026-08-08 · updated: 2026-08-08 · tags: [incident, ics, aviation, transport, advisory, sector-transport] · confidence: high · affected_sectors: [transport] · au_impact: true
CISA Issues ICS Advisory on CPDLC over ATN-B1 Vulnerabilities (Five CVEs)
CISA released ICS advisory ICSA-26-219-01 covering five CVEs (CVE-2025-71409 through 71413, CVSS 7.1) affecting Controller-Pilot Data Link Communications (CPDLC) over ATN-B1.
Key Details
- Source: CISA
- Date: 2026-08-07
- Reliability: Tier 1/4 — Official / first-party
- Nature: ICS advisory — air-traffic-control data link vulnerabilities
Summary
The system relies on legacy clear-text, unauthenticated radio-frequency links that allow unauthorised message injection, denial-of-service, and forced session resets in the air-traffic-control data link. Reported by Armasuisse researcher Martin Strohmeier.
CISA notes this does not constitute an unsafe aircraft condition but can degrade operational safety margins by increasing workload and delaying safety-critical instruction delivery.
Related Pages
- Cve 2025 71409 Cpdlc Atn B1 — One of the five CVEs in this advisory
Sources: raw/digests/Cyber-Digest-2026-08-08