Maritime Cyber Threat Intelligence Brief

1) Maritime Cyber Threat Intelligence Brief

Immediate Priority: A government advisory discloses a remotely exploitable command injection vulnerability in Cobham SATCOM VSAT7090 maritime satellite routers with public exploit code available. Compromise of shipboard or offshore SATCOM could enable loss of communications, pivoting into vessel IT/OT networks, and degradation of safety-critical information flow. Confidence: High. Government Advisory

2) Report Date

Tuesday, September 08, 2026

3) Overall Maritime Cyber Threat Level

HIGH

Basis: Critical SATCOM router vulnerability with public exploit code; continued AIS spoofing in deceptive trade practices; ongoing GNSS interference concerns driving navigation-resilience deployments; active but limited-impact government maritime system incident. Confidence: Medium-High.

4) Executive Summary

Available reporting indicates a critical remotely exploitable flaw (command injection) in Cobham SATCOM VSAT7090 maritime satellite routers, with public exploit code, elevating risk to shipboard and offshore communications and potential IT/OT pivot paths. Confidence in this specific vulnerability report is high. Government Advisory
Current reporting suggests maritime authorities continue to face cyber activity pressures: the Philippine Maritime Industry Authority (MARINA) took a system offline after suspicious activity; no data loss confirmed, but the event exposed disaster recovery gaps for critical seafaring services. Supporting Report
The collected intelligence supports an assessment that AIS manipulation and false-flag tactics remain active in deceptive maritime trade, with recent analysis of a sanctioned tanker’s spoofed positions in the Middle East Gulf. This activity may increase risk to compliance screening and maritime domain awareness rather than ship control systems. View Article
Navigation risk drivers persist: a major vehicle carrier operator (Höegh Autoliners) plans fleet-wide navigation resilience technology deployments in response to GNSS jamming/spoofing on major routes—signaling industry adaptation rather than a discrete new incident. Source
Regulatory posture is strengthening: U.S. MARAD reiterates risks from foreign adversarial technological, physical, and cyber influence with concrete mitigations for port OT and cranes; the U.S. Coast Guard established an Office of Maritime Cybersecurity Policy to coordinate policy across the Marine Transportation System. MARAD Advisory View Article
Operational and safety implications: near-term focus should be on SATCOM hardening and patch pathways, improved segmentation at the IT/OT boundary, validated GNSS resilience and cross-check procedures, and continuity planning for maritime digital services. Confidence in this outlook is medium.

5) Key Findings

Critical Cobham SATCOM VSAT7090 command injection vulnerability (public exploit available) significantly elevates risk to maritime communications and potential lateral movement into vessel or offshore networks. Confidence: High. Government Advisory

MARINA (Philippines) reported a cybersecurity incident requiring precautionary system shutdown; no confirmed data exfiltration, but disaster recovery and resilience gaps were identified for critical maritime services. Confidence: Medium. Supporting Report

AIS manipulation and false-flag deception continue to complicate maritime compliance and situational awareness, illustrated by a sanctioned tanker’s spoofed positions in the Middle East Gulf. Confidence: Medium. View Article

Industry response to GNSS jamming/spoofing is accelerating, with Höegh Autoliners commencing fleet-wide navigation resilience deployments beginning September 2026. Confidence: Medium. Source

U.S. maritime cyber governance is consolidating via MARAD advisories with OT mitigations and a new U.S. Coast Guard Office of Maritime Cybersecurity Policy to coordinate national-level policy. Confidence: High. MARAD Advisory View Article

6) Maritime Threat Dashboard

Overall Threat Level

HIGH

Total Intelligence Records Analyzed

6

ESCALATE Events

1

MONITOR Events

5

Active Incidents

1

Vulnerabilities / CVEs

1

Navigation-Related Threats

2

High-Confidence Assessments

3

7) Top Five Priority Threats

#1 Cobham SATCOM VSAT7090 Command Injection Vulnerability

Threat Level: CRITICAL Decision: C:ESCALATE Domain: Maritime communications / SATCOM Confidence: High

Why it matters: Public exploit code for remotely exploitable command injection creates immediate exposure for vessels and offshore assets using affected VSAT7090 routers.
Operational impact: Potential loss of communications, command channel manipulation, and attacker pivot into onboard networks.
Affected technology: Cobham SATCOM VSAT7090 (versions up to 20260704), CVE-2026-83772.
Recommended attention: Prioritize patching or compensating controls, restrict management interfaces, and segment SATCOM from OT.

Government Advisory

#2 MARINA (Philippines) Cybersecurity Incident Affecting Seafaring Services

Threat Level: HIGH Decision: B:MONITOR Domain: Maritime government services Confidence: Medium

Why it matters: Disruption to SID/SRB-related digital services can affect crew documentation, scheduling, and port clearance workflows.
Operational impact: Administrative delays and potential knock-on logistics impacts; no confirmed data theft per reporting.
Recommended attention: Validate business continuity for regulatory/crew services; ensure alternate processes for documentation.

Supporting Report

#3 AIS Spoofing and False-Flag Deception in Middle East Gulf

Threat Level: HIGH Decision: B:MONITOR Domain: Maritime domain awareness / compliance Confidence: Medium

Why it matters: AIS falsification degrades situational awareness and complicates sanctions/compliance screening and trade risk assessment.
Operational impact: Increased verification burden for cargo/voyage history; potential for routing and insurance risk adjustments.
Recommended attention: Cross-check AIS with sensor fusion and port state control data; escalate anomalies for compliance review.

View Article

#4 GNSS Jamming/Spoofing Drives Fleet Navigation Resilience Deployment

Threat Level: MODERATE Decision: B:MONITOR Domain: Navigation / bridge systems Confidence: Medium

Why it matters: Sustained GNSS disruption risk across key routes necessitates resilient navigation and cross-check procedures.
Operational impact: Potential loss of position confidence, route deviations, and schedule impacts if not mitigated.
Recommended attention: Validate multi-sensor navigation resilience and crew procedures for GNSS anomalies.

Source

#5 MARAD Advisory on Foreign Adversarial Technological and Cyber Influence

Threat Level: HIGH Decision: B:MONITOR Domain: Ports / terminals / vessel operators Confidence: High

Why it matters: Highlights elevated risk and provides specific mitigations for port cranes and maritime OT segmentation.
Operational impact: Strengthened access control and monitoring reduce likelihood of crane and port network compromise.
Recommended attention: Implement advisory-aligned access control, OT segmentation, and monitoring controls.

MARAD Advisory

8) Maritime Operational Relevance Assessment

Vessel navigation and bridge systems: Continued GNSS interference risk necessitates sensor cross-checks and resilient navigation deployments (analytical synthesis from industry actions).
Shipboard IT/OT: SATCOM router exploitation could provide remote footholds; segmentation and strict remote-access control are critical (supported by CSIRT advisory).
Port and terminal operations: MARAD guidance underscores crane and port network segmentation and monitoring priorities (supported by MARAD advisory).
Maritime communications: VSAT7090 vulnerability directly threatens communications availability and confidentiality (supported by CSIRT advisory).
Maritime logistics and compliance: AIS spoofing requires enhanced verification to prevent deceptive trades and domain awareness gaps (supported by reporting).
Business continuity: The MARINA incident highlights the need for disaster recovery and continuity planning for regulatory digital services (supported by MARINA report).

9) Port and Terminal Cyber Activity

MARAD advisory emphasizes OT segmentation, access control, and monitoring for port crane and network environments. MARAD Advisory
U.S. Coast Guard Office of Maritime Cybersecurity Policy establishment indicates increasing regulatory coordination impacting ports and facilities. View Article

10) Vessel and Shipboard System Security

Immediate focus on Cobham VSAT7090 patching/mitigations to prevent remote takeover and lateral movement onboard. Government Advisory
Apply strict management interface controls and inventory checks for satellite terminals to ensure only supported, updated firmware is in use (derived best practice).

11) Navigation, GPS, GNSS, AIS, and ECDIS Threat Watch

GNSS jamming/spoofing remains a strategic risk driver prompting fleet-level resilience deployments and navigation cross-validation procedures. Source
AIS manipulation case highlights ongoing risks to maritime domain awareness; treat AIS data as untrusted and corroborate with independent sensors and port records. View Article

12) Maritime OT and ICS Assessment

Port crane OT segmentation and monitoring remain priority controls (explicit in MARAD advisory). MARAD Advisory
Shipboard OT exposure increases if SATCOM devices bridge IT/OT networks; enforce one-way data flows or secure gateways, and monitor for configuration drift (analytical).

13) Offshore Energy and Undersea Infrastructure

Offshore platforms using VSAT7090 should prioritize remediation; a successful exploit could impact remote operations, telemetry, and vendor access (supported by CSIRT advisory). Government Advisory

14) Maritime Communications and Satellite Systems

VSAT7090 vulnerability presents a direct communications-layer threat; immediate mitigations reduce risk of C2 channel subversion and data compromise. Government Advisory

15) Maritime Supply Chain and Logistics Risks

Regulatory services disruption (MARINA) can cascade into crew clearance delays and voyage scheduling friction; ensure contingency documentation processes (supported by MARINA report). Supporting Report
AIS spoofing increases compliance verification workload and risk of cargo/voyage misrepresentation (supported by reporting). View Article

16) Threat Actor and Campaign Activity

No specific named threat actors were identified in the supplied reporting. AIS falsification and GNSS interference are persistent techniques used in deceptive maritime activity; attribution varies and is not established in these records.

17) Vulnerability and CVE Watch

CVE-2026-83772 — Cobham SATCOM VSAT7090 Maritime Satellite Router

Type: Command Injection via JSON parsing; remote arbitrary command execution possible.
Affected versions: up to 20260704.
Status: Public exploit code available (per advisory). Confidence: High.
Action: Patch/upgrade when available; restrict management access; segment from OT; monitor for anomalous commands. Government Advisory

18) Affected Vendors and Technologies

Cobham SATCOM — VSAT7090 Maritime Satellite Router (CVE-2026-83772). Advisory

19) Affected Maritime Sectors

Vessel operators (shipboard communications and navigation resilience).
Ports and terminals (OT segmentation and crane environments per MARAD).
Government maritime services (administrative and regulatory digital platforms).
Offshore energy (platform communications exposure via VSAT).

20) TTPs and MITRE ATT&CK-Style Observations

Exploitation of internet-exposed SATCOM management interfaces leading to remote command execution (observed behavior per advisory; no specific ATT&CK ID asserted).
AIS position falsification and false-flag identity manipulation to obfuscate vessel movements (behavioral tactic; not mapped to a specific ATT&CK technique here).
Precautionary shutdown following repeated suspicious activity on a government maritime system (general incident response containment; insufficient detail for ATT&CK mapping).

21) Safety, Environmental, and Operational Impact

Safety: Loss or manipulation of comms could impede distress coordination and safety-of-life communications (analytical risk from VSAT exposure).
Operational: GNSS degradation and AIS falsification can disrupt routing confidence and port operations verification processes.
Environmental: No direct environmental impact identified in the supplied reporting; indirect risk if navigation degradation contributes to incidents (analytical, low confidence).

22) Regulatory and Government Advisory Watch

MARAD 2026-007 advisory emphasizes access control, recovery planning, monitoring, and OT segmentation for ports and vessels; includes crane-specific mitigations. MARAD Advisory
U.S. Coast Guard establishes Office of Maritime Cybersecurity Policy to centralize cyber policy for the Marine Transportation System. View Article

23) Defensive Mitigation Priorities

Urgent: Inventory and remediate Cobham SATCOM VSAT7090 devices; apply vendor updates, disable or restrict remote management, enforce ACLs/VPN, and monitor for suspicious commands. Government Advisory
Segment SATCOM from OT networks; implement unidirectional gateways or robust firewalls where feasible (derived best practice aligned with MARAD segmentation guidance). MARAD Advisory
Enhance access control and monitoring for port crane and OT environments; review vendor remote access and logging per advisory guidance. MARAD Advisory
Validate GNSS resilience: configure multi-sensor cross-checks (gyro/LOG/radar/visual), enable alerts for GNSS anomalies, and drill bridge teams on loss-of-GNSS procedures (analytical practice prompted by industry actions). Industry Report
Strengthen business continuity and disaster recovery for maritime digital services (crew documentation, clearances); maintain offline/alternate workflows. Supporting Report
Implement AIS anomaly detection workflows and compliance fusion checks (AIS vs. LRIT, satellite imagery, port call records) to counter spoofing (derived best practice).

24) Next 72-Hour Maritime Cyber Outlook

Analysts should monitor for vendor patches, exploitation reports, and detection guidance related to CVE-2026-83772; immediate risk remains elevated for unsegmented VSAT7090 deployments. Confidence: High. Government Advisory
Continued reporting is likely on AIS manipulation cases in high-scrutiny trade lanes; expect additional compliance advisories or insurer notices. Confidence: Medium. View Article
Additional organizational policy and guidance may emerge as the U.S. Coast Guard’s new cybersecurity policy office initiates outreach and coordination. Confidence: Medium. View Article
There is insufficient information to determine further operational impact from the MARINA incident in the next 72 hours; risk to dependent stakeholders is limited but warrants contingency checks. Confidence: Medium-Low. Supporting Report

25) Intelligence Event Cards

C:ESCALATE

CVE-2026-83772 — Cobham SATCOM VSAT7090 Command Injection

Threat Level: CRITICAL • Confidence: High • Publication: 2026-09-03 • Source: National CSIRT-CY / Digital Security Authority (Government)

A government advisory details a command injection vulnerability affecting Cobham SATCOM VSAT7090 maritime satellite routers (versions up to 20260704). Public exploit code is available, enabling remote arbitrary command execution. Operational risk includes loss of comms, attacker foothold on vessel/offshore networks, and potential lateral movement.

Domain: Maritime communications / SATCOM
Systems: VSAT7090 management and routing functions
CVE: CVE-2026-83772
Navigation impact: Possible (via degraded situational info flow)
Safety impact: Possible (impeded emergency comms)
Supply chain impact: None stated
Mitigations: Patch/upgrade, restrict management access, segment from OT, monitor logs

Article: Cobham SATCOM VSAT7090 Maritime Satellite Router Command Injection Vulnerability — View Article

B:MONITOR

MARINA System Disruption Following Suspicious Cyber Activity

Threat Level: HIGH • Confidence: Medium • Publication: 2026-09-01 • Source: Maritime Industry Authority (Government)

MARINA reported taking an affected system offline as a precaution after repeated suspicious activity. No data loss or personal data compromise was identified, but the event highlighted the absence of a dedicated disaster recovery capability for critical maritime digital services.

Domain: Government maritime services
Navigation impact: Unknown • Safety impact: Unknown
Operational impact: Potential delays to seafaring documentation and services
Mitigations: Implement disaster recovery, improve monitoring and access controls

Article: TO COUNTER CYBER THREATS AMID SID/SRB DISRUPTION... — View Article

MARAD Advisory: Foreign Adversarial Technological, Physical, and Cyber Influence

Threat Level: HIGH • Confidence: High • Publication: 2026-04-24 • Source: MARAD (Government)

MARAD warns of persistent global risks to maritime stakeholders and provides specific mitigations for port crane environments and OT segmentation, referencing U.S. Coast Guard directives.

Domain: Ports, terminals, vessels
Safety impact: Possible • Supply-chain impact: Possible
Mitigations: Access control hardening, recovery planning, OT segmentation, monitoring

Advisory: 2026-007-Worldwide-Worldwide-Foreign Adversarial Technological, Physical, and Cyber Influence — View Advisory

AIS Spoofing and False-Flag Activity: Middle East Gulf Case

Threat Level: HIGH • Confidence: Medium • Publication: 2026-09-02 • Source: Lloyd's List (Maritime Industry)

Reporting describes a sanctioned tanker allegedly spoofing AIS positions to appear off Khor al Zubair under a false Nicaraguan flag. The case illustrates ongoing AIS falsification and identity deception in maritime trade.

Domain: Maritime domain awareness / compliance
Navigation impact: Possible (situational-awareness degradation)
Safety impact: Possible (misleading traffic picture)
Mitigations: Cross-validate AIS with alternative sensors and records; escalate anomalies

Article: SOMO denies links to sanctioned false flag tanker... — View Article

USCG Establishes Office of Maritime Cybersecurity Policy

Threat Level: HIGH • Confidence: High • Publication: 2026-09-01 • Source: SecurityWeek (News)

The U.S. Coast Guard established a central office to coordinate cyber policy for the Marine Transportation System, indicating stronger governance and engagement with industry and government partners.

Domain: Policy and governance across ports, vessels, facilities
Operational impact: Anticipated policy alignment and potential future directives

Article: Coast Guard Establishes Office of Maritime Cybersecurity Policy — View Article

Höegh Autoliners: Fleet Navigation Resilience Deployment

Threat Level: MODERATE • Confidence: Medium • Publication: 2026-08-31 • Source: The Maritime Executive (Maritime Industry)

Höegh Autoliners plans to equip its fleet with navigation resilience technology starting September 2026 in response to persistent GNSS jamming and spoofing on major routes.

Domain: Navigation / bridge systems
Navigation impact: Possible • Safety impact: Possible
Mitigations: Multi-sensor validation, anomaly alerts, crew training

Article: Höegh Autoliners to Equip Entire Fleet with New Navigation Resilience Techn — View Article

A:IGNORE

No A:IGNORE events in this cycle.

26) Source Reference Section

Cobham SATCOM VSAT7090 Maritime Satellite Router Command Injection Vulnerability — National CSIRT-CY / Digital Security Authority — 2026-09-03 Link
TO COUNTER CYBER THREATS AMID SID/SRB DISRUPTION, MARINA SEEKS FUNDING FOR DISASTER RECOVERY SYSTEM, NATIONWIDE TECH REFRESH — Maritime Industry Authority — 2026-09-01 Link
2026-007-Worldwide-Worldwide-Foreign Adversarial Technological, Physical, and Cyber Influence — MARAD — 2026-04-24 Link
SOMO denies links to sanctioned false flag tanker as scrutiny grows over spoofed Middle East Gulf voyages — Lloyd's List — 2026-09-02 Link
Coast Guard Establishes Office of Maritime Cybersecurity Policy — SecurityWeek — 2026-09-01 Link
Höegh Autoliners to Equip Entire Fleet with New Navigation Resilience Techn — The Maritime Executive — 2026-08-31 Link