What are the potential impacts of these cyberattacks on ATG systems?

Compromised ATG systems can lead to altered network settings, tank volumes, and pump controls, disabling alerts and preventing accurate monitoring, thereby increasing the risk of leaks or equipment failures.

What measures can organizations take to protect ATG systems from cyberattacks?

Organizations should block ATG systems from internet exposure, restrict remote access through firewalls or VPNs, replace default passwords with strong credentials, implement multifactor authentication, apply security updates, and monitor systems for unauthorized changes.

CISA Issues Warning on Cyberattacks Targeting Fuel Tank Monitoring Systems

Recent cyberattacks on ATG systems in critical infrastructure sectors prompt urgent calls for enhanced cybersecurity measures to prevent operational disruptions.

Published: June 4, 2026

Share this on:

Executive Summary

In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, NSA, and Department of Energy, issued a warning about cyberattacks targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across critical infrastructure sectors. Attackers exploited vulnerabilities such as authentication bypasses, hardcoded credentials, and command-execution flaws to gain unauthorized access, allowing them to alter network settings, tank volumes, and pump controls. This manipulation could disable alerts and hinder operators from accurately monitoring tank levels, increasing the risk of leaks or equipment failures.

This incident underscores the growing threat to operational technology (OT) systems within critical infrastructure. The exploitation of ATG systems highlights the need for enhanced cybersecurity measures, including restricting internet exposure, implementing strong authentication protocols, and applying timely security updates to prevent unauthorized access and potential operational disruptions.

Why This Matters Now

The targeting of ATG systems in critical infrastructure sectors reveals a pressing need to secure operational technology against cyber threats. Immediate action is required to mitigate vulnerabilities that could lead to significant operational disruptions and safety hazards.

Attack Path Analysis

Attackers exploited internet-exposed Automatic Tank Gauge (ATG) systems by leveraging authentication bypass vulnerabilities and default credentials, gaining unauthorized access. They escalated privileges by exploiting command execution flaws, allowing them to modify system settings. Subsequently, they moved laterally within the network to access other critical systems. The attackers established command and control channels to maintain persistent access. They exfiltrated sensitive operational data from the compromised systems. Finally, they manipulated tank levels and disabled alerts, potentially leading to environmental hazards and operational disruptions.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

High

Lateral Movement

Medium

Command & Control

Medium

Exfiltration

Medium

Impact

High

Initial Compromise

Description

Attackers exploited internet-exposed ATG systems by leveraging authentication bypass vulnerabilities and default credentials, gaining unauthorized access.

Confidence:

High

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2024-45066
CVSS 9.8
An authentication bypass vulnerability in the ProGauge MagLink LX ATG system allows remote attackers to gain unauthorized access.
Affected Products:
ProGauge MagLink LX – All versions prior to patch
Exploit Status:
exploited in the wild
References:
https://www.darkreading.com/ics-ot-security/fuel-tank-monitoring-systems-vulnerable-disruption
CVE-2024-43693
CVSS 9.8
A command injection vulnerability in the ProGauge MagLink LX ATG system allows remote attackers to execute arbitrary commands.
Affected Products:
ProGauge MagLink LX – All versions prior to patch
Exploit Status:
exploited in the wild
References:
https://www.darkreading.com/ics-ot-security/fuel-tank-monitoring-systems-vulnerable-disruption

MITRE ATT&CK® Techniques

Initial Access

T1078

Valid Accounts

Privilege Escalation

T1068

Exploitation for Privilege Escalation

Privilege Escalation

T1134

Access Token Manipulation

Privilege Escalation

T1548

Abuse Elevation Control Mechanism

Initial Access

T1190

Exploit Public-Facing Application

Persistence

T1505

Server Software Component

Command and Control

T1071

Application Layer Protocol

Impact

T1496

Resource Hijacking

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Change Default Passwords

Control ID: 8.2.4

The use of hardcoded credentials and default passwords in ATG systems violates the requirement to change default passwords and remove or disable unnecessary default accounts before installing a system on the network.

NYDFS 23 NYCRR 500 – Access Privileges

Control ID: 500.07

Unauthorized access through authentication bypass vulnerabilities indicates a failure to limit user access privileges to information systems that provide access to nonpublic information.

DORA – ICT Risk Management Framework

Control ID: Article 6

The exploitation of ATG systems due to unpatched vulnerabilities reflects inadequate implementation of an ICT risk management framework to ensure the security and resilience of network and information systems.

CISA ZTMM 2.0 – Identity and Access Management

Control ID: 3.1

The incident demonstrates a lack of robust identity and access management controls, as attackers were able to exploit authentication mechanisms to gain unauthorized access.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Article 21

The successful attacks on ATG systems highlight deficiencies in implementing appropriate technical and organizational measures to manage cybersecurity risks, as required by the directive.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Oil/Energy/Solar/Greentech

Critical infrastructure targeting of fuel tank monitoring systems exposes energy sector to authentication bypass, command execution, and operational technology compromise risks.

Chemicals

ATG system vulnerabilities enable attackers to manipulate chemical storage tank monitoring, disable leak detection alerts, and compromise safety-critical industrial control systems.

Food Production

Internet-exposed automatic tank gauge systems in food production facilities face SQL injection and privilege escalation attacks affecting liquid storage monitoring capabilities.

Transportation

Transportation sector fuel management systems vulnerable to Iranian-linked attacks exploiting hardcoded credentials and authentication bypass in ATG monitoring infrastructure.

Sources

CISA warns of cyberattacks targeting fuel tank monitoring systemshttps://www.bleepingcomputer.com/news/security/cisa-warns-of-cyberattacks-targeting-fuel-tank-monitoring-systems/
Verified

CISA and Partners Urge Hardening Automatic Tank Gauge Systemshttps://www.cisa.gov/resources-tools/resources/cisa-and-partners-urge-hardening-automatic-tank-gauge-systems

Verified

Critical Vulnerabilities Discovered in Automated Tank Gauge Systemshttps://www.bitsight.com/blog/critical-vulnerabilities-discovered-automated-tank-gauge-systems

Verified

Many Fuel Tank Monitoring Systems Vulnerable to Disruptionhttps://www.darkreading.com/ics-ot-security/fuel-tank-monitoring-systems-vulnerable-disruption

Verified

Frequently Asked Questions

Attackers are exploiting authentication bypasses, hardcoded credentials, command-execution flaws, SQL injection vulnerabilities, and privilege-escalation weaknesses in ATG systems.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit unauthorized access, privilege escalation, and lateral movement within the network, thereby reducing the attacker's ability to compromise critical systems and exfiltrate sensitive data.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The attacker's ability to gain unauthorized access to ATG systems would likely be constrained, reducing the risk of initial compromise.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The attacker's ability to escalate privileges and modify system settings would likely be constrained, reducing the risk of unauthorized system changes.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The attacker's ability to move laterally within the network to access other critical systems would likely be constrained, reducing the risk of further system compromises.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The attacker's ability to establish command and control channels to maintain persistent access would likely be constrained, reducing the risk of sustained unauthorized presence.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The attacker's ability to exfiltrate sensitive operational data from the compromised systems would likely be constrained, reducing the risk of data loss.

Impact (Mitigations)

The attacker's ability to manipulate tank levels and disable alerts would likely be constrained, reducing the risk of environmental hazards and operational disruptions.

Impact at a Glance

Affected Business Functions

Fuel Monitoring
Leak Detection
Inventory Management

Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $500,000

Data Exposure

Operational data related to fuel levels, temperatures, and leak detection.

Recommended Actions

• Implement Zero Trust Segmentation to restrict access to ATG systems and prevent lateral movement.
• Enforce strong authentication mechanisms, including multifactor authentication, to mitigate authentication bypass vulnerabilities.
• Deploy Intrusion Prevention Systems (IPS) to detect and block command execution exploits.
• Utilize Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
• Establish comprehensive monitoring and anomaly detection to identify and respond to unauthorized system modifications promptly.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

CISA Issues Warning on Cyberattacks Targeting Fuel Tank Monitoring Systems

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2024-45066

Affected Products:

Exploit Status:

References:

CVE-2024-43693

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Valid Accounts

Exploitation for Privilege Escalation

Access Token Manipulation

Abuse Elevation Control Mechanism

Exploit Public-Facing Application

Server Software Component

Application Layer Protocol

Resource Hijacking

Potential Compliance Exposure

PCI DSS 4.0 – Change Default Passwords

NYDFS 23 NYCRR 500 – Access Privileges

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Identity and Access Management

NIS2 Directive – Cybersecurity Risk Management Measures

Sector Implications

Oil/Energy/Solar/Greentech

Chemicals

Food Production

Transportation

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads