OT-ISAC Warns of Aviation Supply-Chain Exposure via Amadeus PSS Access and Exploited Ivanti Connect Secure Flaws
The OT-ISAC published two reports warning that Asia-Pacific aviation cybersecurity risks extend beyond airline IT networks into shared supplier platforms, passenger reservation systems and airport OT. One report details unauthorized access to Amadeus passenger service system (PSS) accounts, exposing booking data tied to Japan Airlines, All Nippon Airways, Cathay Pacific and Singapore Airlines — roughly 92,000 JAL/JTA, 37,800 ANA, 53,000 Cathay Pacific and 46,000 Singapore Airlines records. The origin of the compromised credentials and the attacker's identity remain under investigation, and OT-ISAC stresses this is distinct from a separately disclosed Amadeus booking-display vulnerability and from an unrelated Southwest Airlines service outage. The second report flags remote-access infrastructure risk via three actively exploited Ivanti Connect Secure vulnerabilities added to CISA's KEV catalog, plus weaknesses in legacy aviation communication protocols (ADS-B, ACARS, CPDLC).
Entenda a falha
A vulnerabilidade
The story lists three Ivanti Connect Secure CVEs: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527. CISA added them to its KEV catalog in October 2026 and confirmed active exploitation. The articles give no flaw type, CVSS score, attacker prerequisites or affected and fixed versions. They say only that a compromised gateway can lead to credential exposure and lateral movement into engineering, baggage-handling and operational support networks. Some in-memory activity can evade a clean result from Ivanti's Integrity Checker Tool. The Amadeus PSS data exposure is a separate matter: it involves misused credentials on a system account, not a CVE.
Como funciona
The articles do not describe how the Ivanti flaws work internally. They say only that exploited gateways, which sit at the edge and often serve vendor or engineering access, give attackers a path to credentials and then to internal operational networks. Some activity runs in memory, so integrity checks may not show it. In the Amadeus case, credentials tied to a system account were used to reach reservation data on a shared supplier platform, exposing several airlines at once without breaching their own networks.
Por que é vulnerável
The articles do not give the root cause of the three Ivanti CVEs. For the Amadeus exposure, OT-ISAC points to service-account misuse, insufficient oversight of third-party identities and the concentration of passenger data on shared supplier platforms. The origin of the compromised credentials is still under investigation.
Como foi descoberta
CISA confirmed exploitation of the three Ivanti CVEs and added them to the KEV catalog in October 2026. OT-ISAC cited them in a report published on 5 November 2026. The articles do not say who found the flaws or how they were reported. The Amadeus access incidents were disclosed through the affected airlines' reports. The attacker's identity and the full scope remain under investigation.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 10:19.
Detalhes técnicos
The exposed Amadeus incidents involve misuse of a system service account and insufficient oversight of third-party identities on a shared supplier platform, which can expose multiple airlines without a breach of their own corporate networks. CISA confirmed active exploitation of CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure, with some in-memory activity capable of evading Ivanti's Integrity Checker Tool, enabling credential exposure and lateral movement into engineering, baggage-handling and operational support networks. OT-ISAC also cites lab research showing injection and disconnection conditions on legacy CPDLC links, though it found no substantiated malicious compromise of Asia-Pacific airside control equipment.
Remediação
OT-ISAC recommends reviewing supplier/service-account privileges, monitoring unusual logins and bulk data queries, preserving authentication and API logs, and rotating affected credentials and tokens. For remote access, it advises prioritizing exposed Ivanti gateways, assessing compromise via network and memory evidence, enforcing multifactor authentication through monitored jump hosts, mapping third-party access paths into airport networks, segmenting OT networks, and rehearsing manual fallback procedures for check-in, boarding and baggage operations.
Linha do tempo
-
OT-ISAC Warns of Aviation Supply-Chain Exposure via Amadeus PSS Access and Exploited Ivanti Connect Secure Flaws
ler a análise desta fonte ocultar
The OT-ISAC published two reports warning that Asia-Pacific aviation cybersecurity risks extend beyond airline IT networks into shared supplier platforms, passenger reservation systems and airport OT. One report details unauthorized access to Amadeus passenger service system (PSS) accounts, exposing booking data tied to Japan Airlines, All Nippon Airways, Cathay Pacific and Singapore Airlines — roughly 92,000 JAL/JTA, 37,800 ANA, 53,000 Cathay Pacific and 46,000 Singapore Airlines records. The origin of the compromised credentials and the attacker's identity remain under investigation, and OT-ISAC stresses this is distinct from a separately disclosed Amadeus booking-display vulnerability and from an unrelated Southwest Airlines service outage. The second report flags remote-access infrastructure risk via three actively exploited Ivanti Connect Secure vulnerabilities added to CISA's KEV catalog, plus weaknesses in legacy aviation communication protocols (ADS-B, ACARS, CPDLC).
Technical Details
The exposed Amadeus incidents involve misuse of a system service account and insufficient oversight of third-party identities on a shared supplier platform, which can expose multiple airlines without a breach of their own corporate networks. CISA confirmed active exploitation of CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure, with some in-memory activity capable of evading Ivanti's Integrity Checker Tool, enabling credential exposure and lateral movement into engineering, baggage-handling and operational support networks. OT-ISAC also cites lab research showing injection and disconnection conditions on legacy CPDLC links, though it found no substantiated malicious compromise of Asia-Pacific airside control equipment.
Remediation
OT-ISAC recommends reviewing supplier/service-account privileges, monitoring unusual logins and bulk data queries, preserving authentication and API logs, and rotating affected credentials and tokens. For remote access, it advises prioritizing exposed Ivanti gateways, assessing compromise via network and memory evidence, enforcing multifactor authentication through monitored jump hosts, mapping third-party access paths into airport networks, segmenting OT networks, and rehearsing manual fallback procedures for check-in, boarding and baggage operations.