CISA ICS Advisory: CPDLC over ATN-B1 Vulnerabilities

CISA published an ICS advisory on August 07, 2026, detailing multiple vulnerabilities in Controller-Pilot Data Link Communications (CPDLC) over ATN-B1.

Clear-text unauthenticated RF links

The advisory states that ATN-B1 CPDLC relies on legacy clear-text unauthenticated radio frequency links. Research shows these design characteristics enable unauthorized message injection, denial-of-service conditions, and forced session resets. The flaws do not create an unsafe aircraft condition. However, successful exploitation could degrade operational safety margins by increasing pilot and controller workload, delaying safety-critical instructions, and reducing situational awareness. The advisory does not state whether the vulnerabilities have been exploited in the wild.

Affected systems

All versions of CPDLC over ATN-B1 are affected. The advisory lists four CVEs: CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, and CVE-2025-71412. No specific software version numbers or patch levels are provided beyond the designation “vers:all/*”.

What to do

• Determine whether ATN-B1 CPDLC is in use within your aviation or air traffic management systems.
• Review the full technical details in the CISA advisory and any vendor-specific guidance released for these CVEs.
• Implement available mitigations or workarounds listed in the advisory for systems that cannot be updated immediately.
• Monitor official vendor channels and the CISA ICS advisory page for updates on patches or additional mitigations.
• Assess operational procedures to limit exposure to unauthorized RF messages during CPDLC sessions.

Operators of affected aviation communication systems should treat these vulnerabilities as a standing risk until the underlying design characteristics are addressed through future standards or equipment replacement.