CISA Issues Advisory on Five CPDLC over ATN-B1 Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-219-01 on August 7, 2026, disclosing five Common Vulnerabilities and Exposures (CVEs) affecting CPDLC over ATN-B1, a widely used aviation data link protocol operating over Very High Frequency (VHF) radio. The affected CVEs are CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, and CVE-2025-71413.

CPDLC over ATN-B1 relies on legacy clear text unauthenticated radio frequency links. Research demonstrations have shown that these characteristics allow unauthorized message injection, denial-of-service conditions, and forced session resets. The advisory states that these vulnerabilities do not constitute an unsafe aircraft condition but can degrade operational safety margins by increasing workload, delaying safety-critical instructions, and reducing situational awareness.

The specific vulnerability types include:
- CVE-2025-71409: Lack of authentication for Very High Frequency Data Link messages, allowing rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion.
- CVE-2025-71410: Unnumbered Disconnect (U DISC) and malformed Aviation VHF Link Control frames that can terminate sessions, leading to a loss of CPDLC functions requiring reversion to voice communication and increased controller workload.
- CVE-2025-71411: Broadcast control frames that can disconnect multiple aircraft simultaneously, leading to delayed clearances and air traffic controller overload.
- CVE-2025-71412 and CVE-2025-71413: Additional protocol flaws related to missing authorization checks and improper handling of unusual or exceptional conditions.

All affected products are described as CPDLC over ATN-B1 Vulnerabilities running Advisory Circular 90-117 Data Link Communications, with product version vers:all/* (indicating all versions are affected). CVSS scores for the vulnerabilities range from 5.3 to 7.1, with base severities rated HIGH for most vectors. The relevant CWEs include CWE-306 (Missing Authentication for Critical Function) and CWE-770 (Allocation of Resources Without Limits or Throttling).

Mitigation information currently states that no patches or mitigations are available. CISA notes that the vulnerabilities are exploitable in lab environments but require very specific conditions and are unlikely to be exploited outside of such settings. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Organizations observing suspected malicious activity are advised to follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

The advisory covers Critical Infrastructure Sectors: Transportation Systems, with worldwide deployment. The Federal Aviation Administration (FAA) Advisory Circular 90-117 Data Link Communications is identified as the governing standard.