A study accepted at the 2026 IEEE Symposium on Security and Privacy, titled SatBleed, concludes that a single class of commercial off-the-shelf radio module used across small satellites can give an attacker a path from the uplink straight into the spacecraft bus, and that encrypting telemetry does nothing to stop it.
The paper, written by Ulysse Planta, Julian Rederlechner, Martin Strohmeier, Mathias Fischer and Ali Abbasi of CISPA Helmholtz Center for Information Security, armasuisse Science and Technology, and the University of Hamburg, examines the communication subsystem that nearly every small satellite relies on to receive commands and send telemetry. That subsystem, the researchers argue, is treated as a dumb pipe by spacecraft designers even though it sits in the most exposed position on the whole platform: permanently listening, permanently reachable from the ground, and permanently trusted by everything downstream.
A trust assumption built into the architecture
The team built a threat taxonomy specifically for attacks against this communication subsystem, then analyzed representative commercial modules from multiple vendors against it. They found weaknesses spanning firmware, the command protocols the modules speak, and the way the modules are wired into a satellite's broader architecture. None of the three categories of flaw requires physical access to the spacecraft. All of them are reachable from a ground antenna pointed at the sky.
To estimate real-world exposure, the researchers cross-referenced their findings against open-source telemetry and mission data rather than relying on lab conditions alone. Out of 64 active missions in their dataset, they judged at least 28 plausibly vulnerable to hostile takeover of the communication link, a group spanning research cubesats, commercial smallsats and operational constellations that share the same handful of off-the-shelf radio designs.
Why encrypted telemetry does not help
The paper's sharpest point is architectural rather than cryptographic. Operators who encrypt telemetry and command traffic often assume that protects the link end to end. SatBleed shows that the communication module itself processes incoming commands before handing them to whichever downstream subsystem performs decryption and authentication checks. An attacker who compromises the radio module does not need to break the encryption at all; they take control upstream of it, at a point the cryptography was never designed to defend.
Telemetry encryption does not prevent SatBleed, because the communication subsystem processes commands before forwarding them to subsystems that may perform decryption.
The AX100 case, from lab to conference stage
Planta put a concrete face on the research on November 5 in a talk closing the first day of Nullcon Berlin, titled "Owning the Uplink: An Excursion into COTS Satellite Hardware." According to a report on the session, he walked through an authentication bypass on GomSpace's NanoCom AX100, a VHF/UHF transceiver with flight heritage going back to the GOMX-3 cubesat and used across numerous customer missions since. Chained together, the flaws gave persistent control of the radio and a pivot path onto the spacecraft's internal bus, turning one compromised transceiver into a foothold across whatever else the satellite carries.
GomSpace's own documentation lists the AX100 at technology readiness level 9, the highest rating available, reflecting years of orbital use on both government and commercial platforms. That maturity is precisely the researchers' point: a widely trusted, well-flown part can still carry the design assumptions of an earlier, lower-stakes era of satellite engineering, when the attacker on the other end of an RF link was a hypothetical rather than a market.
One module, many satellites
Small satellite programs standardize on a narrow set of off-the-shelf subsystems precisely because building a radio from scratch is expensive and slow. That efficiency is what turns a single component flaw into a fleet-wide question. A university cubesat team, a commercial Earth-observation operator and a defense-adjacent technology demonstrator can all be running the same transceiver model, which means a vulnerability discovered against one mission's hardware configuration can be relevant to dozens of others that nobody involved ever directly compared.
That dynamic echoes earlier findings on satellite hardware going back more than a decade, including IOActive's 2014 research on hardcoded credentials in terminal firmware from several major SATCOM vendors and Ruhr University Bochum's 2023 analysis of flight software across three in-orbit satellites. SatBleed's contribution is to treat the communication subsystem as its own attack surface with its own taxonomy, rather than folding radio-level flaws into a general catalog of spacecraft software bugs.
What is still unresolved
Neither the paper's public abstract nor GomSpace's published materials name a patch, a firmware update, or a coordinated disclosure timeline tied to the AX100 findings specifically. The 28-mission estimate is itself a correlation against public telemetry records rather than a confirmed exploitation count, and the researchers frame it as a lower bound on plausible exposure rather than a tally of satellites actually compromised. The open question for operators is whether a ground-segment mitigation, such as authenticating commands before they reach the radio rather than after, can be retrofitted to hardware already in orbit, or whether the fix only reaches the next generation of missions still on the ground.
First reported by CISPA and the University of Hamburg, with additional detail from coverage of Planta's Nullcon Berlin talk.
