When the Clearance Had No Signature: The CPDLC over ATN-B1 Advisory (ICSA-26-219-01) Through a DO-326A and ED-120 Lens

On August 7, 2026, CISA published an ICS advisory whose "Vendor" field is effectively the international air traffic system. Five CVEs. All versions affected. Mitigation available: none. The finding is not a bug in anybody's product — it is that the datalink carrying controller clearances to the flight deck was specified without authentication, and everything built on top of it inherited that.

The interesting sentence in the advisory is not the vulnerability list. It is the disclaimer: these issues "do not constitute an unsafe aircraft condition" but can "degrade operational safety margins by increasing workload, delaying safety-critical instructions, and reducing situational awareness." That is a defensible safety statement and a weak security statement, and the gap between those two things is the whole post.

1. The public record

CISA advisory ICSA-26-219-01, CPDLC over ATN-B1 Vulnerabilities, published August 7, 2026. Affected product: ATN-B1 CPDLC, all versions. Reporter: Martin Strohmeier of armasuisse — the Swiss federal defence procurement and technology agency, whose aviation security group has been publishing on this link layer for the better part of a decade. Five CVEs, all reserved August 4 and published August 7, assigned by the ICS-CERT CNA. (CISA ICSA-26-219-01)

| CVE | Title | CWE | CVSS v4.0 | CVSS v3.1 | |---|---|---|---|---| | CVE-2025-71409 | No authentication for VDL messages used in CPDLC | CWE-306 | 7.1 High | 7.1 High | | CVE-2025-71410 | Malicious link control frames cause loss of CPDLC functions | CWE-770 | 6.0 Medium | 5.3 Medium | | CVE-2025-71411 | Broadcast control frames disconnect multiple aircraft simultaneously | CWE-770 | 6.0 Medium | 5.3 Medium | | CVE-2025-71412 | False emergency or status messages accepted as legitimate | CWE-754 | 7.1 High | 7.1 High | | CVE-2025-71413 | Malformed or out-of-sequence frames cause repeated resets | CWE-754 | 6.0 Medium | 5.3 Medium |

The descriptions are worth reading as engineering statements rather than security boilerplate.

CVE-2025-71409: "Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion." (CVE-2025-71409)

CVE-2025-71410: "Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload." (CVE-2025-71410)

CVE-2025-71411: "Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload." (CVE-2025-71411)

Every one of the five carries the same closing line: "This type of attack can be carried out remotely over radio frequency." And every one carries the same remediation: no mitigation available. CISA's risk framing is that the vulnerabilities are exploitable in a lab, require very specific conditions, are unlikely to be exploited outside a lab, and have no known public exploitation reported.

None of this is new to the research literature, which is exactly the point. Strohmeier's group and collaborators at Oxford published You talkin' to me? Exploring Practical Attacks on Controller Pilot Data Link Communications at the ACM Cyber-Physical System Security Workshop in 2021, demonstrating a man-in-the-middle takeover of an aircraft's datalink session on an attacker-chosen frequency, after which arbitrary CPDLC messages could be delivered to the target without alerting the legitimate controller. (Oxford CS) Work on CPDLC's missing authentication goes back further still — Gurtov, Polishchuk and Wernberg laid it out in Sensors in 2018, and a 2025 review in the Journal of Transportation Security catalogues the full attack taxonomy and concludes, unsurprisingly, that cryptographic message authentication is the missing control. (Sensors 18(5):1636; J Transp Secur 18:23)

So what changed on August 7, 2026 is not the knowledge. It is that a national CERT assigned CVE identifiers to a design property of an ICAO-standardised datalink and wrote "no mitigation available" in the box. That converts a research finding into a tracked, catalogued, auditable defect — and every operator, ANSP and avionics OEM now has an entry in somebody's vulnerability management system pointing at a protocol they cannot patch.

Scale matters here. CPDLC is not a pilot program. The FAA's Data Comm effort completed Departure Clearance service deployment to 62 towers, with en route services layered on top, and the FAA reports general aviation now leading in CPDLC equipage. (FAA Data Comm; NBAA) In European continental airspace, datalink services are mandated rather than optional. This is the routine path by which a clearance reaches a flight deck on an ordinary Tuesday.

2. The standards lens

Three requirement threads should have converged on this link layer. Two of them ran, correctly, and produced the wrong answer because they were asked the wrong question. The third never ran at all.

ED-120 / DO-290 — Safety and Performance Requirements for Data Link in Continental Airspace. This is the document that sets Required Communication Performance for CPDLC services, and it is where the operational safety case lives: RCP allocations for transaction time, continuity, availability and integrity, with voice retained as the reversionary means. ED-120's logic for loss of CPDLC is sound for random failure: the service degrades, the crew and controller revert to voice, workload rises, and the failure condition classification lands in the Minor-to-Major band because a proven backup exists and is always available.

That reasoning has one load-bearing assumption: the outage occurs at a time uncorrelated with operational demand. Availability budgets are computed as probabilities per flight hour precisely because random hardware and RF failures do not care what the sector is doing. An adversary does. CVE-2025-71411 — broadcast control frames disconnecting multiple aircraft simultaneously — is the same functional outcome as an ED-120 continuity failure, except it is simultaneous across the sector and timed. Independence dies twice: across aircraft, and against workload.

ARP4754A / ARP4761A. These are the right tools for the development assurance and safety assessment of the airborne end, and they explicitly do not cover intentional unauthorised interaction. A Functional Hazard Assessment asks what happens if a function is lost, degraded, or produces erroneous output, and it assigns a probability budget. It has no vocabulary for "an attacker chooses erroneous output, chooses the moment, and repeats until it works." Trying to close CVE-2025-71409 inside an FHA is a category error — the probability column has no meaning when the initiating event is a decision rather than a failure rate.

DO-326A / ED-202A — Airworthiness Security Process Specification. This is the clause set that should have caught it, and it is the one whose absence the advisory documents. DO-326A, with its methods companion DO-356A/ED-203A and its operational companion DO-355/ED-204 for continuing airworthiness, defines the process: identify assets, identify threat conditions, assess the Level of Threat, determine the security risk from the combination of Level of Threat and the safety effect, and either accept it or introduce security measures with verifiable effectiveness. The FAA's Aircraft Systems Information Security Protection rulemaking put a dedicated information-security requirement into the airworthiness code at 14 CFR 25.1319 and its sibling parts, precisely so this analysis is not optional. (FAA ASISP)

Run DO-326A honestly against ATN-B1 and the result is not subtle. The Aviation VHF Link Control (AVLC) sublayer of VDL Mode 2 carries no message authentication code. There is no ground-station identity binding. There is no replay protection at the link layer. The X.25-derived connection state machine accepts unauthenticated control frames — including the Unnumbered Disconnect that CVE-2025-71410 turns into a denial of service — from anyone with a transmitter on the right frequency. The integrity of a CPDLC clearance is protected by a CRC against noise and by operational procedure against everything else.

That is the missing artifact in one line: CPDLC's integrity claim is procedural, and it was never written down as a security requirement because the analysis that would have demanded it was never in the certification basis when ATN-B1 was specified.

The procedural controls are real and they are not nothing. Message identifiers and reference numbers, the closed-loop response protocol (WILCO / UNABLE / STANDBY), the CPDLC connection and Current Data Authority model, controller cross-check against the traffic picture, and crew airmanship all raise the bar. CVE-2025-71409's CVSS v4.0 vector encodes this — attack complexity High, and subsequent-system integrity impact High but confidentiality untouched. The attacker is not reading anything. The attacker is writing into a channel the crew has been trained to trust as authoritative.

3. A worked snippet — DO-326A Threat Condition rows

Here is what the missing rows look like. This is the DO-326A Security Risk Assessment format: threat scenario, threat condition, safety effect if realised, failure condition classification per AC 25.1309, Level of Threat, resulting security risk, and the security measure that would drive it acceptable.

| ID | Threat scenario | Threat condition | Safety effect | FC class | Level of Threat | Risk | Security measure | |---|---|---|---|---|---|---|---| | TC-CPDLC-01 | SDR-equipped rogue ground station transmits a well-formed uplink CPDLC message on the active VDL Mode 2 frequency (CVE-2025-71409) | Flight crew receives and may action a clearance that no controller issued | Crew accepts an altitude or heading not coordinated with the sector; loss of separation credible in high-density airspace | Major, credibly Hazardous in a converging-traffic geometry | Moderate — commodity SDR, published research, but requires proximity, frequency knowledge and timing | Unacceptable without measure | Cryptographic message authentication binding ground-station identity to each uplink; crew procedure requiring voice confirmation of any uplink that changes vertical profile without a preceding request | | TC-CPDLC-02 | Injected false emergency or status downlink attributed to a target aircraft (CVE-2025-71412) | ATC and ground operations respond to an emergency that is not occurring | Misallocation of emergency services, airspace clearing, diversion of controller attention from real traffic | Major | Moderate | Unacceptable without measure | Downlink origin authentication; ATC-side plausibility cross-check against surveillance and voice before resource commitment | | TC-CPDLC-03 | Unauthenticated U DISC / malformed AVLC frames terminate an active session (CVE-2025-71410) | Loss of CPDLC for one aircraft, reversion to voice | Increased crew and controller workload; delayed clearance delivery | Minor | Moderate | Acceptable with measure | Link-layer control-frame authentication; bounded automatic re-establishment with rate limiting | | TC-CPDLC-04 | Broadcast control frames disconnect all aircraft on the frequency at once (CVE-2025-71411) | Sector-wide simultaneous loss of CPDLC, timed by the attacker | Controller saturation on a single voice frequency during a peak-demand window; delayed safety-critical instructions | Major, escalating to Hazardous under sector-loading conditions | Moderate | Unacceptable without measure | Reject broadcast disconnects; per-aircraft authenticated teardown only; ANSP-side detection of correlated multi-aircraft logoff | | TC-CPDLC-05 | Repeated malformed / out-of-sequence frames at AVLC and X.25 layers force continuous resets (CVE-2025-71413) | Sustained CPDLC unavailability without a clean failure indication | Degraded situational awareness; ambiguous system state on the flight deck | Minor to Major | Moderate | Acceptable with measure | Input validation and state-machine hardening; explicit, unambiguous CPDLC-unavailable annunciation with rate-limited reconnection |

Note TC-CPDLC-04. Row by row, an ED-120 availability analysis would rate each individual disconnection Minor. The security analysis rates the aggregate, timed, correlated version higher, because the attacker supplies the correlation that the safety analysis assumed away. That single distinction is the reason DO-326A exists as a separate process rather than a chapter in ARP4761A.

Attack tree — top event: crew actions an unauthenticated clearance

TOP: Flight crew executes a clearance that no controller issued
 |
 +-- AND ----------------------------------------------------
      |
      +-- A. Attacker delivers a well-formed uplink to the target
      |    |
      |    +-- A1. Determine active VDL Mode 2 frequency for the sector
      |    +-- A2. Determine target aircraft address / active CDA
      |    +-- A3. Encode valid ATN-B1 CPDLC uplink element
      |    +-- A4. Transmit within radio horizon of target
      |         (no authentication check exists -- CVE-2025-71409, CWE-306)
      |
      +-- B. Message survives all procedural filters
           |
           +-- B1. Content is operationally plausible for the phase of flight
           +-- B2. Crew does not seek voice confirmation
           |        (no procedural requirement to do so for routine uplinks)
           +-- B3. Controller does not observe the deviation in time
           |        to intervene via voice
           +-- B4. Surveillance-based conformance monitoring does not
                    alarm within the intervention window

MITIGATION STATUS
  A4  : NO BARRIER   -- link layer has no MAC, no identity binding
  B1  : NO BARRIER   -- attacker chooses plausible content
  B2  : WEAK BARRIER -- training and airmanship, not a requirement
  B3  : WEAK BARRIER -- depends on controller loading
  B4  : PARTIAL      -- ANSP conformance monitoring, latency not bounded
                        against this threat

Four of the five leaves have no engineered barrier. The system is held together at B2 and B3 by humans doing their jobs well, which is a fine thing to have and a terrible thing to be the only thing you have.

4. Derived requirements (excerpt)

These are written as they would appear in a DO-326A security requirements document with traceability upward to the threat conditions above.

CPDLC-SEC-001 — Uplink origin authentication. Each CPDLC uplink message delivered to the flight deck shall carry a cryptographic authenticator that binds the message contents to the identity of the transmitting Current Data Authority. The airborne end system shall reject and log any uplink failing verification, and shall not present it to the crew. Parent: TC-CPDLC-01, TC-CPDLC-02. Verification: protocol conformance test plus adversarial test with an SDR transmitter injecting valid-format, invalid-authenticator uplinks; acceptance is zero presented messages across the test corpus.

CPDLC-SEC-002 — Authenticated link-layer teardown. The AVLC sublayer shall accept a disconnect or reset only when the requesting frame is authenticated to the peer of the established association. Unauthenticated Unnumbered Disconnect and broadcast disconnect frames shall be discarded without state change. Parent: TC-CPDLC-03, TC-CPDLC-04. Verification: fault-injection at the link layer with malformed, out-of-sequence and broadcast control frames; acceptance is zero unintended session terminations.

CPDLC-SEC-003 — Bounded, rate-limited recovery with unambiguous annunciation. Following any loss of CPDLC association, the system shall attempt re-establishment no more than three times within any 60-second window, and shall annunciate an unambiguous CPDLC-unavailable indication to the crew within 5 seconds of the loss. Repeated reset cycling shall not produce an indeterminate displayed state. Parent: TC-CPDLC-05. Verification: sustained malformed-frame test over 30 minutes with display-state capture; acceptance is a stable, correct annunciation throughout.

CPDLC-SEC-004 — Correlated-logoff detection at the ANSP. The ground system shall raise an operational alert when the number of CPDLC associations lost within a single sector exceeds three within any 30-second window, and shall present that alert to the controller working position together with an explicit voice-reversion prompt. Parent: TC-CPDLC-04. Verification: ground-system simulation with staged multi-aircraft disconnect; acceptance is alert raised within 10 seconds of the third loss.

CPDLC-SEC-005 — Procedural confirmation for uncommanded vertical-profile changes. Until CPDLC-SEC-001 is implemented fleet-wide, operating procedures shall require voice confirmation of any CPDLC uplink that commands a change of assigned altitude or vertical rate and was not preceded by a corresponding downlink request from the flight crew. Parent: TC-CPDLC-01. Verification: procedure published in the operations manual and evidenced in recurrent training records; effectiveness sampled through line operations safety audit. Note: this is an interim compensating control with human-performance-limited effectiveness. It shall not be credited as a permanent security measure.

That last note is the honest part. CPDLC-SEC-005 is what the industry has today, and it was never actually written down as a security control — it is an emergent property of good airmanship. Writing it down as an interim measure with a stated expiry is how you stop it from quietly becoming the permanent answer.

5. What the headline really tells us

The permanent fixes exist and are already in the standards pipeline: ATN/IPS in place of the ISO/OSI ATN stack, LDACS as the terrestrial datalink with its own authenticated control channel, and an aeronautical PKI to make CPDLC-SEC-001 something other than an aspiration. Academic proposals for authenticated key agreement and secure handover on CPDLC have been on the table for years. None of that reaches a flight deck this decade at fleet scale. The gap between now and then is the interval this advisory describes, and it is measured in years.

So the useful reading of ICSA-26-219-01 is not "air traffic control is hackable." It is a documented case of a safety analysis and a security analysis reaching different conclusions about the same failure, with only the safety analysis in the certification basis. ED-120 was right that losing CPDLC is survivable, because voice exists. DO-326A would have been right that losing CPDLC simultaneously, sector-wide, at a moment of the attacker's choosing, on a link with no way to tell a controller from a laptop is a different question — and nobody was required to ask it when ATN-B1 was frozen.

The missing artifact is a Security Risk Assessment against the link layer, with the Level of Threat treated as a decision variable rather than a failure rate. Everything downstream — the five CVEs, the empty mitigation field, the fact that CISA had to write "all versions affected" against an ICAO standard — is the cost of not having produced that document at the time the protocol was specified.

The generalisable question is not about aviation. Take whatever reversionary mode your system depends on — the manual override, the voice channel, the mechanical backup, the human in the loop — and check what its availability argument assumes. If it assumes the primary channel fails at random, ask what happens when something chooses the moment instead. If your answer is "the operator will catch it," write that down as a requirement with a verification method and an expiry date, or admit you are running on an assumption.

The clearance had no signature. Write the requirement.

Sources

— Jherrod Thomas, The Lion of Functional Safety™