The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Critical Vulnerability in NAVTOR NavBox Exposes Maritime Operational Data
In March 2026, a critical vulnerability (CVE-2026-2754) was identified in NAVTOR's NavBox version 4.12.0.3, a maritime connectivity device widely used for managing navigation data and ship-shore communications. The flaw allowed unauthenticated remote attackers to access sensitive configuration and operational data through exposed HTTP API endpoints on TCP port 8080. Exploitation of this vulnerability could lead to unauthorized retrieval of internal network parameters, including ECDIS and OT information, device identifiers, and service status logs, posing significant risks to vessel operations and security. This incident underscores the growing cybersecurity challenges in the maritime industry, especially as operational technology systems become increasingly interconnected. The exposure of critical navigation and operational data highlights the urgent need for robust security measures and regular vulnerability assessments to protect against potential cyber threats targeting maritime infrastructure.
3 months ago
Kill Chain
CISA Issues Warning on Cyberattacks Targeting Fuel Tank Monitoring Systems
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, NSA, and Department of Energy, issued a warning about cyberattacks targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across critical infrastructure sectors. Attackers exploited vulnerabilities such as authentication bypasses, hardcoded credentials, and command-execution flaws to gain unauthorized access, allowing them to alter network settings, tank volumes, and pump controls. This manipulation could disable alerts and hinder operators from accurately monitoring tank levels, increasing the risk of leaks or equipment failures. This incident underscores the growing threat to operational technology (OT) systems within critical infrastructure. The exploitation of ATG systems highlights the need for enhanced cybersecurity measures, including restricting internet exposure, implementing strong authentication protocols, and applying timely security updates to prevent unauthorized access and potential operational disruptions.
3 months ago
Kill Chain
Urgent Advisory: Securing Automatic Tank Gauge Systems Against Cyber Threats
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with multiple federal partners, issued an urgent advisory regarding active cyberattacks targeting Automatic Tank Gauge (ATG) systems across the United States. These systems, integral to monitoring fuel storage tanks in sectors such as Energy, Chemical, Food and Agriculture, and Transportation, were found to be vulnerable due to internet exposure and weak authentication mechanisms. Threat actors exploited these weaknesses to gain unauthorized access, potentially allowing them to manipulate tank levels, disable alarms, and disrupt operations. While no physical damage was reported, the incidents underscored significant cybersecurity gaps in critical infrastructure. ([infoodandfuel.org](https://www.infoodandfuel.org/news/cybersecurity-alert-automatic-tank-gauge-systems-targeted?utm_source=openai)) This advisory highlights the escalating threat landscape for operational technology (OT) systems, emphasizing the need for immediate action to secure ATG systems. The incidents serve as a stark reminder of the vulnerabilities present in internet-exposed OT devices and the potential for malicious actors to exploit these weaknesses to disrupt essential services.
3 months ago
Kill Chain
MacGregor VDR G4e Vulnerabilities Highlight Maritime Cybersecurity Challenges
In May 2026, multiple critical vulnerabilities were identified in the MacGregor Voyage Data Recorder (VDR) G4e, a maritime device essential for recording navigational and operational data. These vulnerabilities, including the use of default and hard-coded credentials, insufficiently protected passwords, and improper access controls, could allow unauthorized attackers to gain administrator access to the device. Such exploitation poses significant risks, including unauthorized data access, manipulation, or deletion, potentially compromising maritime safety and incident investigations. This incident underscores the pressing need for enhanced cybersecurity measures in maritime systems. As vessels increasingly integrate networked technologies, the attack surface expands, making it imperative to address security flaws promptly. The vulnerabilities in the VDR G4e highlight the broader challenge of securing critical infrastructure against evolving cyber threats.
3 months ago
Kill Chain
Critical Security Flaws Discovered in XCharge C6 EV Chargers
In May 2026, multiple critical vulnerabilities were identified in XCharge's C6 electric vehicle charging controllers, including CVE-2026-9037, CVE-2026-9038, and CVE-2026-9039. These flaws could allow attackers to gain administrative rights or execute unauthorized code on affected devices. The vulnerabilities encompass issues such as unverified firmware updates, stack-based buffer overflows, and insecure default configurations. Exploitation of these vulnerabilities could lead to significant control over critical infrastructure in transportation systems worldwide. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-xcharge-c6-ev-chargers-have-3-critical-flaws-cvss-9-8.420545/?utm_source=openai)) The increasing integration of IoT devices in critical infrastructure highlights the urgency of addressing such vulnerabilities. Ensuring robust security measures and timely updates is essential to prevent potential disruptions and maintain the integrity of essential services.
3 months ago
Kill Chain
Critical Vulnerability in ABB Terra AC Wallbox Chargers: CVE-2025-5517
In October 2025, ABB disclosed a heap-based buffer overflow vulnerability (CVE-2025-5517) affecting multiple models of its Terra AC wallbox electric vehicle chargers. This flaw could allow attackers to execute arbitrary code, cause denial-of-service conditions, or gain unauthorized access. Exploitation requires either a man-in-the-middle position with unencrypted communication or a compromised Charging Station Management System (CSMS). ABB has released firmware updates to address this issue and recommends users update their devices promptly. This incident underscores the critical importance of securing industrial control systems, especially as electric vehicle infrastructure becomes more widespread. Organizations should ensure encrypted communications and regularly update firmware to mitigate such vulnerabilities.
4 months ago
Kill Chain
Critical Vulnerabilities Discovered in ABB Terra AC Wallbox EV Chargers
In September 2025, ABB identified multiple buffer overflow vulnerabilities in its Terra AC Wallbox electric vehicle chargers, specifically affecting firmware versions up to 1.8.33. These vulnerabilities, cataloged as CVE-2025-10504, CVE-2025-12142, and CVE-2025-12143, could allow attackers with adjacent network access and high privileges to execute arbitrary code, potentially leading to unauthorized control over the device. ABB promptly released firmware version 1.8.36 to address these issues and recommended immediate updates to mitigate potential risks. The discovery of these vulnerabilities underscores the critical importance of securing IoT devices, especially those connected to critical infrastructure like energy distribution. As the adoption of electric vehicle chargers grows, ensuring robust cybersecurity measures is essential to prevent potential exploitation that could disrupt services and compromise user safety.
4 months ago
Kill Chain
Critical Vulnerability in Palo Alto Networks PAN-OS: CVE-2026-0300
In May 2026, a critical buffer overflow vulnerability (CVE-2026-0300) was identified in the User-ID™ Authentication Portal service of Palo Alto Networks PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability affects PAN-OS versions prior to 12.1.4-h5, 11.2.4-h17, 11.1.4-h33, and 10.2.7-h34. Exploitation has been observed in the wild, primarily targeting systems with the Authentication Portal exposed to untrusted networks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The incident underscores the importance of securing network access to critical services and adhering to best practice guidelines. Organizations are advised to restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses and apply the necessary software updates promptly to mitigate potential risks. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
4 months ago
Kill Chain
Iranian Hackers Compromise U.S. Fuel Monitoring Systems in 2026
In May 2026, Iranian hackers reportedly breached automatic tank gauge (ATG) systems monitoring fuel levels at gas stations across multiple U.S. states. These systems, exposed online without password protection, allowed attackers to alter display readings without affecting actual fuel levels. While no physical damage occurred, the incident underscores vulnerabilities in critical infrastructure. ([abc17news.com](https://abc17news.com/politics/national-politics/cnn-us-politics/2026/05/15/exclusive-hackers-have-breached-tank-readers-at-us-gas-stations-officials-suspect-iran-is-responsible/?utm_source=openai)) This breach highlights the evolving nature of cyber warfare, where nation-state actors target essential services. The incident serves as a stark reminder for organizations to secure internet-facing operational technology systems to prevent potential disruptions and safety hazards.
4 months ago
Kill Chain
Taiwan High Speed Rail Radio Hack: A Wake-Up Call for Critical Infrastructure Security
In April 2026, a 23-year-old university student in Taiwan exploited vulnerabilities in the Taiwan High Speed Rail's (THSR) radio communication system, using software-defined radio equipment to transmit a false 'General Alarm' signal. This unauthorized transmission caused four high-speed trains to halt for 48 minutes, disrupting operations and highlighting significant security flaws in critical infrastructure. The student was arrested and released on bail, facing charges related to endangering public transportation safety. ([taipeitimes.com](https://www.taipeitimes.com/News/taiwan/archives/2026/05/05/2003856781?utm_source=openai)) This incident underscores the pressing need for robust cybersecurity measures in transportation systems, especially as similar vulnerabilities have been exploited in other countries. It serves as a wake-up call for infrastructure operators worldwide to reassess and fortify their communication protocols against potential cyber threats.
4 months ago
Kill Chain
Cyber-Enabled Cargo Theft: A $725 Million Wake-Up Call for the Transportation Industry
In 2025, cybercriminals orchestrated a series of sophisticated attacks targeting the transportation and logistics sectors, resulting in approximately $725 million in cargo theft losses across North America. These threat actors employed phishing emails, spoofed websites, and compromised carrier accounts to infiltrate freight brokers and carriers. Once inside, they posted fraudulent listings on load boards, deceiving legitimate carriers into transporting shipments to unauthorized destinations controlled by the criminals. This method allowed entire truckloads of goods, including pharmaceuticals and consumer products, to be rerouted and stolen without physical hijacking. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai)) The surge in cyber-enabled cargo theft underscores the evolving tactics of organized crime, blending traditional theft with advanced cyber techniques. This trend highlights the urgent need for enhanced cybersecurity measures within the transportation industry to protect against such multifaceted threats.
4 months ago
Kill Chain
Critical Vulnerability in Johnson Controls CEM AC2000: CVE-2026-21661
In May 2026, a critical vulnerability (CVE-2026-21661) was identified in Johnson Controls' CEM AC2000 versions 10.6, 11.0, and 12.0. This flaw, stemming from an uncontrolled search path element, allows standard users to escalate privileges on the host machine via DLL hijacking. The vulnerability affects sectors such as Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy. Johnson Controls has released specific updates to remediate this issue. The incident underscores the persistent risks associated with DLL hijacking vulnerabilities in critical infrastructure systems. Organizations are urged to promptly apply the recommended updates and review their security protocols to prevent potential exploitation.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports