As reported by CISA in advisory ICSA-26-219-01, researchers have formally disclosed a cluster of five vulnerabilities in the Controller-Pilot Data Link Communications (CPDLC) protocol operating over the Aeronautical Telecommunications Network Baseline 1 (ATN-B1) standard — a digital messaging backbone used by commercial aviation worldwide to exchange safety-critical instructions between air traffic controllers and flight crews.

Security Impact: The vulnerabilities exist at the protocol level, meaning they are not attributable to a single vendor's implementation flaw that can be silently patched.

Vulnerability Summary

CVEs
CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, CVE-2025-71413
CVSS v3 Score
7.1 — High
Affected Product
ATN-B1 CPDLC — all versions (vers:all/*)
Vendor
Protocol-level standard; affects all implementations across avionics manufacturers and ground systems conforming to ATN-B1
Patch Available?
No direct patch — architectural mitigations and operational guidance referenced in FAA Advisory Circular 90-117
Exploited in the Wild?
Not confirmed at this time; proof-of-concept research demonstrated
Weakness Types
CWE-306 (Missing Authentication for Critical Function), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-754 (Improper Check for Unusual or Exceptional Conditions)

Why This Matters Beyond the Headlines

The instinct when reading CISA's careful language — "does not constitute an unsafe aircraft condition" — might be reassurance. Security professionals should resist that comfort. The vulnerabilities exist at the protocol level, meaning they are not attributable to a single vendor's implementation flaw that can be silently patched. Every ground station, airline operations center, and air traffic facility using ATN-B1 is structurally exposed.

The attack surface here is particularly interesting because it operates over radio frequency links — inherently broadcast, inherently accessible to anyone within range with appropriate software-defined radio (SDR) hardware that costs less than $50. Three distinct attack classes are now formally documented:

Why This Matters Beyond the Headlines
Unauthorized message injection: An adversary can craft and transmit CPDLC messages that mimic controller instructions to an aircraft. Even if flight crews have procedures to verify ambiguous clearances verbally, injected messages increase workload and create dangerous ambiguity during high-tempo phases of flight such as approach or oceanic entry.
Denial-of-service: Flooding or disrupting the data link channel forces crews and controllers to revert to voice communications — a degraded mode that significantly increases controller workload and reduces capacity, particularly over oceanic routes where voice HF is the only fallback.
Forced session resets: Abrupt disconnection of established CPDLC sessions invalidates pending clearances and requires re-authentication and re-issuance, introducing timing gaps in safety-critical instruction delivery.
Shield53 Assessment: The cumulative effect of these vectors is not a single catastrophic failure — it is the systematic degradation of safety margins across multiple simultaneous flights, precisely when operators are least equipped to absorb additional workload. This is a resilience attack, not a direct safety attack, and that distinction is what makes it strategically interesting to sophisticated threat actors.

Who Is Most at Risk

ATN-B1 CPDLC is predominantly deployed in European and international oceanic airspace, operated by ANSPs (Air Navigation Service Providers) including EUROCONTROL member states. Airlines operating transatlantic and transoceanic routes, along with the ground infrastructure of major hub airports using data link for pre-departure clearances, carry the highest exposure. Regional carriers operating domestically in ACARS/VHF environments use a different protocol stack and are not directly affected by this specific advisory.

Nation-state actors with interests in disrupting civil aviation — whether for intelligence collection, demonstration of capability, or coordinated pressure during geopolitical crises — should be considered plausible threat actors given the technical accessibility of the attack vector and the strategic visibility of aviation disruption.

Immediate Actions

  • Review FAA Advisory Circular 90-117 for operational data link communication procedures; ensure crews are trained to cross-verify unexpected CPDLC clearances via voice when any ambiguity exists.
  • ANSPs and airline dispatch: Audit your CPDLC ground system logging capabilities — anomalous message injection attempts should generate alertable events; confirm whether your current implementation provides any telemetry for unusual session reset patterns.
  • Avionics and ground system vendors: Engage with EUROCAE and RTCA standardization bodies to accelerate work on authenticated data link protocols (ATN-B3/LDACS represents the long-term architectural path forward).
  • Security operations teams supporting aviation clients: Add monitoring for RF-proximate anomalies near major international airports; coordinate with physical security on SDR detection capabilities in sensitive airside areas.
  • Engage with CISA's ICS-CERT and your national ANSP cybersecurity liaison for sector-specific threat intelligence sharing relevant to this advisory.

Shield53 Recommendations

Because this is a protocol-level structural vulnerability with no near-term patch pathway, defenders must accept residual risk and invest in compensating controls and detection rather than remediation. Short-term priorities should focus on crew procedure reinforcement and anomaly logging. Medium-term, aviation security teams should be advocating loudly within their organizations and with regulators for accelerated transition timelines to authenticated next-generation data link standards.

This advisory is also a reminder that ICS and operational technology security in the transportation sector remains chronically under-resourced relative to IT security. The same legacy-by-design constraints that plague industrial control systems are deeply embedded in aviation communications infrastructure — and the consequences of ignoring them accrue silently, in degraded margins, until they don't.