Maritime Cybersecurity in 2026: Why OT Security Can't Wait

Two incidents from 2026 alone make the point better than any warning could: a critical software flaw in a widely used shipboard fleet-management platform, and a cyberattack that forced a U.S. state port system onto manual gate processing. Maritime cybersecurity in 2026 is no longer mainly an IT problem — it is an operational technology (OT) problem, and the systems that steer vessels, manage engines, and move cargo are now squarely in attackers' sights.

Key takeaways

• A critical vulnerability disclosed in September 2026 in Wärtsilä's Fleet Optimisation Solution (FOS) could let a remote attacker push unauthorized updates or impersonate a privileged client.
• North Carolina Ports confirmed a cyberattack in August 2026 that disrupted IT systems at three facilities and forced manual gate processing.
• Independent research reports maritime cyber incidents rose sharply in 2025, with ransomware and malware driving most of the growth.
• IACS Unified Requirements E26 and E27 are moving from guidance to enforcement in 2026, making OT cyber resilience a condition of class certification, not just good practice.

A critical vulnerability in shipboard fleet software

In late September 2026, the Cybersecurity and Infrastructure Security Agency (CISA) published its first advisory covering Wärtsilä's Fleet Optimisation Solution, after maritime cyber research firm Cydome identified hard-coded cryptographic keys in FOS-Onboard version 5.07.0923.01. The flaw was tracked as two critical vulnerabilities, CVE-2026-78225 (CVSS v4 score of 9.5) and CVE-2026-81855 (CVSS v4 score of 9.3). In practice, a remote unauthorized user could exploit the hard-coded keys to push unauthorized software updates, execute code, or impersonate a privileged client.

What makes this notable for OT security specifically is the pivot risk. FOS integrates with voyage and fleet operations data, and researchers flagged it as a possible stepping stone into connected shipboard systems such as navigation, engine management, and fuel systems. Wärtsilä has since issued a patch; the company advises vessel operators and ship managers to contact it directly to confirm their installation and apply the fix. A vulnerability doesn't need to touch bridge systems directly to create a safety-relevant risk — a compromised fleet-performance platform can be enough on its own.

A port authority learns the hard way

Weeks earlier, on August 4, 2026, North Carolina Ports confirmed a cyberattack that disrupted IT systems supporting its Wilmington, Morehead City, and Charlotte facilities. Gate signage read "Operations Alert: System Issues. Expect Delays," and Wilmington switched to manual gate processing while the port authority activated its cybersecurity contingency plan. The authority looped in the NC Department of Transportation, the NC Department of Information Technology, and the U.S. Coast Guard, and said there was no indication sensitive data had been compromised. Recovery was ongoing with no public restoration timeline at the time of writing — a clear example of how an IT-side disruption can cascade directly into physical cargo operations.

The trend data backs it up

These two incidents fit a documented pattern rather than a coincidence. A 2026 maritime cyber threat white paper from CYTUR found that maritime cyber incidents rose 103% in 2025 compared with 2024, with DDoS attacks, ransomware, and malware infections accounting for most of that growth. The same report points to an October 2025 ransomware attack on a maritime electronics equipment maker that disrupted maintenance and emergency parts supply, and a major terminal operator ransomware incident in December 2025. GPS spoofing and jamming — concentrated around conflict zones such as the Strait of Hormuz and the Baltic Sea — continue to be reported against commercial vessels, including oil tankers, adding a navigation-safety dimension to what might otherwise look like a purely IT problem.

As with any vendor research, it's worth reading these figures as one firm's analysis of the incidents it tracked rather than a universal count — but the direction matches what CISA's own ICS advisory volume and the independent incident reports above both show.

Regulation is tightening around OT specifically

This is also the year IACS Unified Requirements E26 (ship cyber resilience) and E27 (onboard systems and equipment cyber resilience) move from guidance toward operational enforcement. Vessels and equipment makers that fail security certification risk losing sailing credentials or being denied port entry — a meaningful commercial consequence that elevates OT cybersecurity from a "nice to have" to a contractual and class-certification requirement for newbuilds and retrofits alike.

What this means for operators

Three practical takeaways stand out for anyone responsible for maritime cybersecurity at a fleet, terminal, or facility level:

• OT asset inventory matters as much as IT inventory. If you don't know which vessels, terminals, or vendors run affected software like FOS-Onboard, you can't patch it.
• Segmentation limits blast radius. Keeping fleet-management, navigation, and engine-control networks separated reduces how far a single compromised platform can reach.
• Incident response plans should assume an IT-side breach can force manual operations at the gate or on the bridge, and should be rehearsed accordingly — not just documented.

None of this requires replacing existing systems overnight. It starts with an honest inventory of what is connected, how, and to what — the same starting point we walk operators through in our OT cybersecurity fundamentals guide.

If you manage vessels, terminals, or connected OT systems and aren't sure where your exposure sits, that's exactly the kind of review worth having before an incident forces the conversation.