Controller-Pilot Data Link Communications (CPDLC) over ATN-B1 does not authenticate Very High Frequency Data Link messages (CWE-306). Rogue ground stations can inject CPDLC messages remotely over radio frequency, leading to unexpected or misleading clearances and potential pilot confusion.

CISA ICS advisory: ICSA-26-219-01.