The 5 stories shaping aviation cybersecurity this week

August 10 - 16

TOP STORY

A Wi-Fi Prank at 35,000 Feet Exposes a Real Gap in Aircraft Cabin Security

A Delta Air Lines flight from Las Vegas to Atlanta became the center of aviation security attention this week after crew discovered an unauthorized wireless network broadcasting inside the cabin, a day after DEF CON wrapped up in Las Vegas. Cabin Wi-Fi was disabled for roughly 30 minutes while crew investigated, and federal authorities met the aircraft after landing.

The incident bears the hallmarks of an evil twin attack, where a rogue network is designed to look identical to a trusted one. Delta has confirmed no aircraft operating systems were affected and flight safety was never in question, but the episode is a pointed reminder of how much of aviation’s cyber exposure now sits in the passenger cabin rather than the cockpit.

Read Full Story

ALSO THIS WEEK

• UAE's National Cyber Defenses Intercept a Coordinated Push Against Aviation and Energy Systems

  The UAE Cybersecurity Council says it detected and stopped a coordinated, multi-vector cyberattack campaign targeting aviation, energy, and education organizations before the attackers could reach their objectives. The campaign reportedly combined direct network intrusion attempts, account compromise efforts, and targeted phishing.

  This is the third major critical-infrastructure campaign publicly disclosed by the UAE in 2026. It reinforces that aviation now sits inside the same national threat model as energy and finance, and that resilience depends heavily on rapid detection and containment.

Read Full Story

• An Explosive-Laden Drone Near a Cargo Jet Signals a New Category of Airport Threat

  Germany’s Leipzig/Halle Airport briefly suspended operations after an unauthorized drone carrying an explosive device was found on the tarmac near a parked cargo aircraft. German officials described it as a new threat scenario, distinct from the surveillance-style drone incursions the country has grown accustomed to responding to.

  Investigators believe a technical malfunction, not successful interception, may be the only reason the device did not detonate before it was found. The incident is a pointed reminder that airport detection infrastructure, including counter-drone radar and sensor systems, is itself digital technology with its own potential blind spots.

Read Full Story

REGULATORY WATCH

A Sixty-Second Physical Connection Could Let an Implant Take Over a 737's Flight Instructions

University of California San Diego researchers, working with a collaborator from Oberlin College, presented a paper at USENIX Security showing that brief physical access to an exposed Boeing 737 maintenance port can let a small hardware implant hijack the aircraft’s ARINC 429 data bus, the decades-old link between the flight-management computer and cockpit displays.

The research reframes physical access to an aircraft as a genuine cybersecurity concern rather than purely a badging and access-control matter. The team disclosed the vulnerability to Boeing well ahead of publication, and the findings apply to a bus technology used broadly across commercial aviation, not just the 737.

Read Full Story

RESEARCH WATCH

Researchers Show How a Cheap Radio Setup Can Talk Directly to a Commercial Aircraft's Digital Air Traffic Link

At USENIX Security ‘26, researchers presented a full security analysis of CPDLC, the digital messaging system increasingly used between controllers and aircraft in place of voice radio, finding that it relies on protocol complexity rather than real authentication or encryption. Using inexpensive software-defined radio equipment, the team built a working fake ground station that certified avionics accepted as legitimate in a live test environment.

The findings echo earlier research on CPDLC and ACARS and reinforce a broader pattern across legacy aviation communication protocols: systems designed when radio access itself was the security control now face a very different threat landscape, one where the equipment needed to participate is cheap and widely available.

Read Full Story

SKYRAY INSIGHT

This week’s stories cover very different corners of aviation: a cabin Wi-Fi incident, a national cyber defense campaign, a drone found near a cargo jet, and two separate research disclosures involving an aircraft’s physical data bus and its digital communication link to the ground. But they share a common thread. The aviation cyber risk surface has expanded well beyond the aircraft’s flight-critical systems, into passenger connectivity, ground infrastructure, physical perimeter detection, and the unauthenticated wiring and messaging links tying aircraft systems together and to the ground.

Understanding that full surface starts with visibility. Knowing exactly which systems, protocols, physical access points, and configurations exist across a fleet and its supporting infrastructure is the foundation for spotting the kind of anomalies these stories describe, whether that is a rogue network broadcasting where it should not be, unauthenticated data on a bus that should be trusted, or a detection system with a gap large enough for something to slip through unnoticed.

As connected aircraft, legacy protocols, and physical maintenance interfaces continue to coexist across the same operating environment, aviation organizations benefit from continuous, aircraft-level threat visibility paired with the kind of regulatory and threat intelligence context that helps teams prioritize what actually matters.

Learn more about SkyRay

FROM THE CYVIATION TEAM

Every story in this issue looks, on the surface, like a different kind of problem. A rogue Wi-Fi network is a passenger-facing nuisance. A nation-state style campaign against critical infrastructure is a geopolitical concern. A drone near a cargo plane is a physical security failure. Two research papers about a data bus and a messaging protocol are academic findings.

The lesson worth carrying forward is that aviation cybersecurity does not live in one department, one system, or one type of incident. It spans the cabin, the network, the perimeter, and the physical and digital links connecting aircraft systems to each other and to the ground, often all at once. Building real operational resilience means treating those as connected pieces of the same picture rather than isolated events to be handled by whichever team happens to own that particular system.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 4 stories shaping aviation cybersecurity this week

July 31 – August 9

TOP STORY

A Weapon That Clears Security

Pilots don’t carry paper anymore. Everything is on a tablet, and that tablet pulls what it needs over ordinary Wi-Fi. CYVIATION researchers placed a fifty-dollar phone next to a real airline-issued Electronic Flight Bag loaded with the briefing for an actual scheduled flight. It took seconds.

From that one seat, they compromised the EFB, took an entire network offline, filled the air with spoofed networks passengers could not distinguish from real ones, and intercepted Bluetooth devices. The phone went through airport security in a pocket without a second look. Security took the nail scissors and waved it straight through.

What makes it possible is that the radios inside a phone were never limited to the job they were sold for. At 35,000 feet there are a few hundred people sitting shoulder to shoulder for hours sharing the same airwaves, and not one of them can step out of range. None of this even has to work for a flight to suffer, which is the strangest part of all. Two aircraft were grounded this year over nothing more than a device name. Both were jokes. The full investigation is on the CYVIATION website.

Read Full Story

ALSO THIS WEEK

• One Facility, Two Hours, Nine States: What the Minneapolis ARTCC Outage Reveals About Aviation’s Resilience Assumptions

  On August 6, an equipment failure at Minneapolis Center knocked out both radar and voice communications across a nine-state region for two hours. The outage was not a cyberattack, and that distinction matters. But a facility designed with purpose-built redundancy going to ATC Zero from an equipment failure alone exposes exactly the class of structural concentration point that cyber risk planning needs to account for. If the operational impact looks like this without an adversarial component, the risk picture with one is a question worth asking now.

Read Full Story

• A Preliminary NTSB Report Puts Military GPS Jamming at the Center of a Fatal Medevac Crash

  The NTSB has released a preliminary report on the May 14 crash of a medevac flight in New Mexico, finding that military GPS jamming from a scheduled electronic warfare exercise was active in the area when the aircraft lost navigation shortly after takeoff. All four people aboard were killed when the aircraft struck a mountain ridge. The jamming was briefly paused on request, then resumed several minutes before the crash. This is believed to be the first documented case of military GPS jamming linked to a fatal civilian crash in U.S. airspace.

Read Full Story

REGULATORY WATCH

EU Extends Mandatory Incident Reporting to Drones, U-space, and Information Security Occurrences

The European Commission has published an update to its civil aviation occurrence reporting rules, formally adding uncrewed aircraft systems, U-space airspace events, and Part-IS information security incidents to the list of occurrences organizations are required to report.

The change brings drone and U-space operations into the same reporting rigor long applied to crewed aviation, and it links information security incidents under Part-IS directly to the EU’s core occurrence reporting infrastructure rather than leaving them in a separate process.

Read Full Story

SKYRAY INSIGHT

This week’s four stories span the full range of aviation’s connected attack surface. A hands-on research demonstration shows what is reachable from a single passenger seat using hardware that costs fifty dollars and clears security every time. A fatal crash links military GPS jamming to a loss of navigation at a critical phase of flight. An equipment failure at a single FAA facility takes nine states of airspace offline for two hours without any adversarial involvement at all. And Europe formally extends its mandatory reporting infrastructure to cover information security incidents for the first time.

The thread connecting all four is dependency without visibility. A flight deck depending on an EFB whose wireless surface nobody is actively monitoring. A crew depending on a GPS signal they have no way to verify. A national airspace system depending on redundancy that failed alongside the system it was supposed to back up. A reporting architecture that, until this week, had no formal category for the information security events already happening inside it.

SkyRay supports aviation organizations in understanding exactly what they are running, what it connects to, and where the dependencies are, before those dependencies surface in an incident rather than an audit.

Learn more about SkyRay

FROM THE CYVIATION TEAM

The lead story this week is our own. A fifty-dollar phone. A real airline-issued EFB. A single seat. The question we set out to answer was simple: how much of what we assume is secure in the cabin is secure because of a decision someone made, and how much is secure because the tools to challenge it used to be expensive and rare? The answer, at least for the wireless layer around an Electronic Flight Bag, is mostly the second one. That stopped being a safe assumption some time ago.

Alongside it, two stories that ask the same question from a different direction. A medevac crew that lost GPS navigation during an active jamming exercise. A redundant FAA facility that still went to ATC Zero. In each case the system did what it was designed to do, right up until it didn’t. The gap between design intent and operational reality is where most of this week’s stories live, and it is the gap that aviation cybersecurity exists to close.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 4 stories shaping aviation cybersecurity this week

July 24–31

TOP STORY

Iranian State-Linked Hackers Add Aviation to a Widening Target List

A newly disclosed espionage campaign, attributed to an Iranian state-linked group tracked as Nimbus Manticore, has deployed a previously undocumented Windows backdoor and two custom tunneling tools against targets across the Middle East, Africa, and South Asia, including an aviation organization in Pakistan.

The tools are designed to maintain long-term covert access, turning compromised systems into relay points that let attackers route traffic as though it originated from inside the victim’s own network. This is at least the second time in recent months this group has been linked to activity touching aviation and aerospace-adjacent targets.

The pattern points to aviation becoming a recurring, rather than occasional, target for state-linked cyber operations, reinforcing the need for continuous network visibility that can catch covert relay behavior before it becomes long-term persistence.

Read Full Story

ALSO THIS WEEK

• Ransomware Actors Target the Software Aerospace Manufacturers Use to Manage Product Data

  A Cl0p-linked ransomware affiliate is actively exploiting a critical, unauthenticated flaw in PTC's Windchill and FlexPLM platforms, with aerospace manufacturers named among the primary targets. The campaign highlights how engineering and design data, not just passenger information, has become a valuable target across the aerospace supply chain.

Read Full Story

• A Third Frontier Airlines Security Incident Raises Questions About Unresolved Vulnerabilities

  A newly emerged extortion group has claimed a breach of Frontier Airlines, arriving on the heels of a months-old unpatched mobile app vulnerability and a separate, already-disclosed data incident. The pattern illustrates how delayed remediation of a single reported flaw can compound into repeated exposure.

Read Full Story

RESEARCH WATCH

Where the Money Is Actually Lost: A Conversation on Ground Risk and Aircraft Blindness

CYVIATION CEO Eliran Almog sat down with Help Net Security to unpack why ground systems, not in-flight hacking scenarios, account for nearly all realized aviation cyber losses, and why the aircraft itself remains the industry’s biggest blind spot.

The conversation covers GNSS jamming that produces no SIEM alert, the company’s own disclosure of CVE-2026-1579 in PX4 Autopilot, why the electronic flight bag is a symptom rather than the root problem, and what a small carrier with limited security staff should prioritize first.

Read Full Story

SKYRAY INSIGHT

This week’s coverage spans state-linked espionage, aerospace supply chain ransomware, and a compounding airline vulnerability story, three different developments united by a single theme: aviation cyber risk lives across the entire ecosystem, from covert network intrusions to unresolved API flaws sitting quietly for months before they resurface as an incident.

The common thread, echoed directly in this week’s conversation with our own CEO, is that visibility determines how quickly an organization can respond. Covert relay tools are built to look like normal traffic. A vulnerability reported once and left unresolved can resurface as a second or third incident. And on the aircraft itself, the data flowing between ground and air often goes unmonitored entirely, not because it is unimportant, but because most operators lack a way to see it.

SkyRay supports this shift by delivering aircraft-level cyber intelligence through a non-intrusive digital twin. By analyzing available aircraft, configuration, maintenance, and threat-intelligence data, SkyRay helps aviation stakeholders identify cyber exposure, strengthen resilience, and support regulatory readiness without touching the aircraft or affecting airworthiness.

Learn more about SkyRay

FROM THE CYVIATION TEAM

This week’s stories underline a consistent lesson: aviation cyber risk rarely announces itself all at once. It shows up as a relay node quietly forwarding traffic, or a vulnerability report that sits unresolved until it resurfaces as an actual breach. In each case, the organizations best positioned to respond are the ones that already had visibility into what their systems looked like before something changed.

Whether the issue involves state-linked espionage, supply chain exposure, or unresolved vulnerabilities in customer-facing systems, effective aviation cybersecurity depends on understanding your own configuration and dependencies well enough to notice when something is wrong, and acting on that knowledge before it compounds.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 5 stories shaping aviation cybersecurity this week

July 17–24

TOP STORY

Aviation Cyber Oversight Is Struggling to Keep Pace

A new Government Accountability Office (GAO) audit found that the FAA has only fully implemented three of seven cybersecurity objectives designed to protect critical aviation systems. The report also concluded that the TSA continues to rely on an outdated cybersecurity roadmap that no longer aligns with current Department of Homeland Security strategy.

The findings demonstrate that as aviation systems become increasingly interconnected, cybersecurity governance must evolve just as rapidly to protect operational resilience.

Read Full Story

ALSO THIS WEEK

• Frontier Faces Legal Scrutiny Following Cybersecurity Breach

  Frontier Airlines is facing proposed class action lawsuits alleging that insufficient cybersecurity safeguards contributed to separate incidents involving employee and customer information. The complaints also raise concerns about how quickly affected individuals were notified and the airline’s responsibility for protecting sensitive data.

Read Full Story

• Qantas Data Exposure Highlights the Importance of Strong Privacy Governance

  A cyber incident involving approximately 5.67 million Qantas customer records has placed renewed attention on how airlines protect passenger information and respond to large-scale data exposure. The case highlights the operational and reputational importance of strong data governance, incident response and transparent communication.

Read Full Story

REGULATORY WATCH

Federal Cybersecurity Gaps Leave Aviation Infrastructure More Exposed

Beyond identifying shortcomings, the GAO outlined several actions needed to strengthen aviation cybersecurity oversight. Recommendations include updating TSA’s cybersecurity roadmap, clearly assigning implementation responsibilities, improving FAA cybersecurity reporting, advancing zero trust implementation, and strengthening oversight of cybersecurity strategy execution.

The report reinforces that effective cybersecurity depends not only on technology, but also on clearly defined governance and sustained implementation across the aviation sector.

Read Regulatory Analysis

SECURITY WATCH

Passenger Identity Claims Trigger Fresh Aviation Security Petition

A petition in Nigeria has called for an investigation into allegations that passengers travelled using false identities. The claims remain allegations and have not been established as formal findings, but the case places attention on the importance of consistent passenger identification and verification procedures across commercial aviation.

Read Full Story

SKYRAY INSIGHT

This week’s coverage demonstrates that aviation cyber risk extends across the entire ecosystem, from government oversight and airline networks to passenger data and identity controls.

The reported incidents and audit findings also show that policies alone are not enough. Aviation organizations need clear accountability, current security strategies and continuous visibility into how cyber exposure may affect their systems and operations.

SkyRay supports this shift by delivering aircraft-level cyber intelligence through a non-intrusive digital twin. By analyzing available aircraft, configuration, maintenance and threat-intelligence data, SkyRay helps aviation stakeholders identify cyber exposure, strengthen resilience and support regulatory readiness without touching the aircraft or affecting airworthiness.

Learn more about SkyRay

FROM THE CYVIATION TEAM

This week’s stories highlight a common challenge across aviation cybersecurity: responsibility must be clearly defined, security controls must be continuously maintained and risks must be understood before they develop into wider operational consequences.

Whether the issue involves aging government strategies, airline data protection or passenger identity procedures, effective cyber resilience depends on visibility, accountability and coordinated action across the aviation ecosystem.

At CYVIATION, our goal is to provide aviation stakeholders with practical intelligence that helps them understand cyber risk before it becomes operational risk.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 5 stories shaping aviation cybersecurity this week

July 10–17 • 5 min read

TOP STORY

Emerging Technologies Are Strengthening Defenses Against GPS Interference

Reports of GPS jamming and spoofing continue to rise worldwide, driving the development of resilient navigation technologies that combine alternative positioning methods, advanced inertial navigation, and multi-sensor solutions to help aircraft maintain safe operations during signal interference.

Read Full Story

ALSO THIS WEEK

• Securing AI Before It Becomes Your Next Cyber Risk

  As artificial intelligence becomes embedded across business operations, organizations are being urged to strengthen AI governance, secure AI systems, and manage new risks including prompt injection, shadow AI, and third-party AI integrations.

Read Full Story

• Data Security Is Becoming a Core Aviation Risk

  A recent Frontier Airlines data breach serves as another reminder that protecting passenger information has become a critical part of aviation cybersecurity and operational resilience.

Read Full Story

• The Connected Cabin Is Shaping the Future of Passenger Experience

  The continued growth of connected cabin technologies and in-flight entertainment systems is creating new opportunities for passenger experience while expanding the digital environment that must be secured throughout an aircraft's lifecycle.

Read Full Story

REGULATORY WATCH

Airport Security Procedures Depend on Consistent Enforcement

A recent airport security incident highlights the importance of consistently enforcing operational procedures, protecting restricted areas, and maintaining strong physical and digital security across airport operations.

Read Regulatory Analysis

SKYRAY INSIGHT

This week’s stories reinforce a common theme across aviation: connectivity and cybersecurity are advancing together.

From resilient navigation technologies and AI governance to passenger data protection, connected aircraft systems, and airport security, aviation organizations are operating in increasingly complex digital environments.

As aircraft, airports, and supporting infrastructure become more connected, maintaining continuous visibility into cyber exposure is becoming essential for operational resilience and regulatory readiness.

SkyRay helps organizations understand aircraft-level cyber risk through a non-intrusive digital twin, delivering continuous cyber visibility, actionable threat intelligence, and compliance support without impacting aircraft operations.

Learn more about SkyRay

FROM THE CYVIATION TEAM

Innovation continues to transform every part of aviation, from navigation and passenger connectivity to artificial intelligence and airport operations.

With every new digital capability comes new cyber considerations. Building resilience requires more than responding to incidents. It requires continuous visibility, proactive risk management, and collaboration across operations, maintenance, and cybersecurity teams.

At CYVIATION, we remain committed to delivering practical aviation cyber intelligence that helps the industry stay informed, prepared, and resilient.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 7 stories that mattered this week

July 2–9 • 5 min read

TOP STORY

EASA Strengthens Guidance on GNSS Jamming and Spoofing

EASA updated its GNSS interference guidance as jamming and spoofing events continue to increase across global aviation. The new guidance reinforces the need for stronger operational preparedness, crew training, EFB considerations, and resilience planning.

Read Full Story

ALSO THIS WEEK

• Boeing Expands Aviation Cybersecurity with SkyGuard

  Boeing introduced SkyGuard, a cybersecurity service that integrates CYVIATION’s SkyRay platform to give aviation operators greater aircraft-level cyber visibility and support regulatory readiness.

Read Full Story

• AI Is Reshaping the Phishing Threat Facing Aviation

  Artificial intelligence is making phishing attacks more convincing, increasing cyber risk across business aviation and reinforcing the need for strong cybersecurity awareness.

Read Full Story

• Why Cybersecurity Must Become Part of Aerospace Quality

  As aerospace systems become more digital, cybersecurity is becoming part of quality, safety, supplier oversight, and operational excellence.

Read Full Story

• Proactive Security Starts with Testing Before Attackers Do

  Operational technology penetration testing is becoming an important way for aviation and industrial organizations to identify cyber risks before attackers exploit them.

Read Full Story

REGULATORY WATCH

Building Aviation Regulations for the Next Generation of Technology

European aviation leaders are emphasizing the need for regulations that support safety while enabling innovation in cybersecurity, artificial intelligence, drones, and emerging aviation technologies.

Read Regulatory Analysis

INDUSTRY WATCH

Thales Strengthens Cybersecurity Leadership Across India and SAARC

Thales appointed Tushar Haralkar as Director of Sales Engineering for India and SAARC, reflecting continued demand for technical cybersecurity expertise across critical industries.

Read Full Story

SKYRAY INSIGHT

This week’s coverage shows how aviation cybersecurity is moving from isolated IT protection toward continuous, operationally aware risk management.

From GNSS interference and AI-powered phishing to aerospace quality, OT testing, and evolving regulatory expectations, aviation organizations need greater visibility into where cyber risk exists and how it may affect operations.

SkyRay supports this shift by providing aircraft-level cyber intelligence through a non-intrusive digital twin. By analyzing available aircraft, maintenance, configuration, and intelligence data, SkyRay helps aviation organizations identify cyber exposure, strengthen resilience, and support regulatory readiness without touching the aircraft or affecting airworthiness.

Learn more about SkyRay

FROM THE CYVIATION TEAM

This week’s stories highlight a clear trend: aviation cybersecurity is becoming more connected to safety, quality, operations, and compliance.

As threats become more sophisticated and regulations continue to evolve, aviation organizations will need to move from reactive cybersecurity toward continuous visibility, proactive testing, and stronger operational resilience.

At CYVIATION, our goal is to provide practical intelligence that helps aviation stakeholders understand cyber risk before it becomes operational risk.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The 5 stories that mattered this week

June 24–30 • 4 min read

TOP STORY

Understanding Today’s Aviation Cybersecurity Threat Landscape

As aviation becomes increasingly connected, cybersecurity has become a critical component of operational resilience. This week’s featured research examines today’s cyber threat landscape, the vulnerabilities affecting airlines, airports, manufacturers, and MROs, and the practical steps organizations can take to strengthen their cybersecurity posture.

Read Full Story

ALSO THIS WEEK

• Why Aviation Cybersecurity Depends on Greater Industry Collaboration Growing cyber threats require stronger collaboration between airlines, airports, regulators, manufacturers, and cybersecurity providers.cybersecurity considerations across the aviation ecosystem.

  Read Full Story

• Locked Skies: Cyber Risk Rises in the Age of Connected Aircraft

  Aircraft connectivity continues to improve operational efficiency while introducing new cybersecurity considerations across the aviation ecosystem.considerations across the aviation ecosystem.

  Read Full Story

• Critical Aviation Vulnerability Identified in PX4 Autopilot Software

  A newly identified vulnerability affecting PX4 autopilot software highlights the importance of monitoring vulnerabilities in aviation-related software components.

  Read Full Story

• Cyber Resilience Takes Center Stage Across Aviation

  Cyber resilience is becoming a strategic priority as aviation organizations strengthen their ability to identify, respond to, and recover from cyber threats.

  Read Full Story

REGULATORY WATCH

FAA Audit Reveals Cybersecurity Gaps in Critical Air Traffic Control Systems

A recent FAA audit identified cybersecurity gaps within critical air traffic control systems, reinforcing the need for continued investment in cyber resilience across aviation infrastructure.

Read Regulatory Analysis

CRITICAL AVIATION VULNERABILITIES

Critical Aviation Vulnerability Identified in PX4 Autopilot Software

CVE: CVE-2026-1579

Severity: Critical (CVSS 9.8)

Summary: A newly disclosed vulnerability affecting PX4 Autopilot, one of the world’s most widely used open-source flight control platforms, highlights the growing importance of securing aviation software and command communications. The vulnerability impacts communication mechanisms used by drones and unmanned aerial vehicles across commercial, emergency response, defense, and research environments.

Read Full Analysis

Critical Aviation Vulnerability Identified in NASA cFS Memory Management Module

CVE: CVE-2025-25373

Severity: Critical (CVSS 9.8)

Summary: A critical vulnerability affecting the Memory Management Module of NASA’s Core Flight System (cFS) Aquila could allow remote code execution through insecure permission assignments. The finding reinforces the importance of securing mission-critical aviation software and embedded systems.

Read Full Analysis

Why This Matters

Critical vulnerabilities affecting aviation software, flight control platforms, and mission systems demonstrate that cybersecurity must extend beyond enterprise IT. Continuous visibility into software vulnerabilities enables aviation organizations to assess potential operational impacts and prioritize remediation before threats can be exploited.

SKYRAY INSIGHT

Cyber risk in aviation is no longer limited to enterprise IT. Modern aircraft operate within highly connected ecosystems that include avionics, maintenance systems, operational technology, third-party suppliers, airport infrastructure, and navigation services.

SkyRay provides aircraft-level cyber visibility by creating a non-intrusive digital twin of each aircraft. Rather than interacting with certified aircraft systems, SkyRay analyzes available aircraft, maintenance, configuration, and intelligence data to identify vulnerabilities, assess cyber exposure, and support regulatory readiness without affecting airworthiness.

Learn more about SkyRay

FROM THE CYVIATION TEAM

This week, our coverage highlights how aviation cybersecurity continues to evolve beyond traditional IT. As aircraft become more connected and software plays an increasingly critical role in operations, organizations must remain vigilant against emerging vulnerabilities, strengthen collaboration across the industry, and prepare for an increasingly complex threat landscape. At CYVIATION, our goal is to provide practical intelligence that helps aviation stakeholders make informed cybersecurity decisions before risks become incidents.

Discover how SkyRay delivers aircraft-level cyber intelligence, continuous threat visibility, and actionable insights to help aviation organizations strengthen cybersecurity and operational resilience.

Book a SkyRay Demo

The vulnerability affects the Memory Management Module of NASA’s Core Flight System (cFS) Aquila, where insecure permissions could allow an attacker to achieve remote code execution (RCE) on the platform.

Key Findings

• CVE: CVE-2025-25373

• Severity: Critical

• CVSS Score: 9.8

• CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)

• Affected Devices: 2

• Exploitability Score: 3.9

• Impact Score: 5.9

According to the vulnerability description, improper permission controls within the memory management component may enable unauthorized execution of code, creating a significant security risk for affected deployments.

Aviation Relevance

CYVIATION’s analysis mapped this vulnerability to AV-T0020 – Avionics Memory Tampering within the AV-ATT&CK framework.

Memory tampering techniques target avionics storage and memory components to alter system behavior, compromise software integrity, or introduce unauthorized functionality.

The affected devices identified include:

• FMGC_1

• FMGC_2

Both are associated with avionics environments where software integrity and secure memory management are essential to safe operations.

Why It Matters

As aviation systems continue to rely on increasingly complex software architectures, vulnerabilities within core system components can have far-reaching consequences.

While exploitation conditions vary by deployment, this vulnerability demonstrates how weaknesses in permission management can create opportunities for attackers to gain elevated access to critical systems.

CYVIATION Assessment

CVE-2025-25373 reinforces the importance of continuous vulnerability monitoring, software assurance, and aircraft-level asset visibility.

Organizations should review affected systems, validate software configurations, and prioritize remediation efforts where applicable to reduce operational and cybersecurity risk.