TLP:CLEAR · Disclosure is not limited.

Eurasia: US-Iran Exchanges Keep Gulf Shipping Under Pressure

Time window: Last 1 day · Audience: General analyst · Type: Situation report · DTG: 2026-09-18 02:07Z · Overall confidence: HIGH

BLUF

Direct US-Iran military exchanges are likely to continue over the next 14 days, while shipping through the Strait of Hormuz is very likely to remain severely disrupted rather than completely halted. Diplomatic messages from Washington, Tehran and Beijing have not overcome Iran's stated conditions for talks, and Houthi activity continues to threaten the Red Sea route.

Executive summary

The International Maritime Organization reports 80 verified attacks on shipping in and around the Strait of Hormuz since 28 February, causing at least 22 seafarer deaths, while as many as 400 ships carrying about 6,000 seafarers have been unable to depart the Persian Gulf safely. A US-contracted vessel was reportedly hit in an Iranian attack earlier this week. US Coast Guard and FBI boardings of two foreign-flagged vessels also indicate maritime cyber compromises, although Iran's role is unproven. Iran's Mohsen Rezaei rejects talks until Tehran's conditions are met, while President Masoud Pezeshkian and President Donald Trump have expressed openness to dialogue. Houthi advances and attacks continue to threaten Saudi-linked shipping and the Bab el-Mandeb, but reporting conflicts over the extent of Houthi territorial control.

Change from previous assessment

Since the 17 September brief, the assessment now has broader evidence for maritime disruption: the IMO reports 80 verified attacks, at least 22 seafarer deaths and as many as 400 ships with about 6,000 seafarers unable to depart safely. A reported attack on a US-contracted vessel and the US Coast Guard and FBI investigation into two compromised foreign-flagged vessels add new maritime and cyber dimensions. The Houthi judgement remains medium confidence but now places greater weight on the threat to the Bab el-Mandeb, while retaining the unresolved conflict over whether Houthi forces already control the relevant coast. The assessment of an immediate US-Iran cessation remains unlikely, and the low-confidence judgement on attack attribution remains unchanged. Initial assessment added for the maritime cyber dimension.

Key judgments

1. Direct US-Iran military exchanges are likely to continue over the next 14 days around the Strait of Hormuz and across the wider region. The US military destroyed two IRGC-N fast-attack craft after an attempted seizure of a US unmanned surface vessel, while reporting also describes Iranian missile and drone attacks and a strike on a US-contracted vessel. The continuation assessment is inferential, so confidence is medium despite consistent reporting on recent incidents. (Confidence: medium · ASSESSED)

• I&W: Confirm: CENTCOM, Iranian authorities or maritime reporting records another exchange involving IRGC-N craft, an Iranian missile or drone launch, or a US strike in the Gulf or against Iranian targets. (0-14 days)
• I&W: Break: US and Iranian authorities announce and observe a halt in strikes, attempted seizures and attacks on vessels for at least seven consecutive days. (0-14 days)

2. Shipping through the Strait of Hormuz is very likely to remain severely disrupted over the next 14 days, but a complete halt is not established. The IMO reports 80 verified attacks since 28 February and as many as 400 ships with about 6,000 seafarers unable to depart safely. Named incidents involving the El Gaia, Hercules Star and Sidr, together with reported flows of 18 million barrels on one day and an 11 million barrel seven-day average, show both serious disruption and continued movement. IMO reporting, trade coverage and flow data provide high confidence in this assessment. (Confidence: high · ASSESSED)

• I&W: Confirm: The IMO or maritime tracking data records additional attacks, continued vessel queues or further inability of merchant ships to depart, with flows remaining below the 2025 reference level of about 20 million barrels per day. (0-14 days)
• I&W: Break: Verified commercial traffic and oil flows return repeatedly to roughly 20 million barrels per day with no additional attacks on merchant vessels. (0-14 days)

3. It is unlikely that a single actor will be established as responsible for the full set of attacks on shipping in the Strait of Hormuz and the East-West pipeline over the next 14 days. One report attributes an attack on a US-contracted vessel to Iran, while the IMO Secretary-General states that attacks in the Strait cannot be assigned to one country. Reporting also differs over whether the East-West pipeline attack involved Iranian proxies in Iraq alone or both those groups and the Houthis. This judgement rests on thin and conflicting attribution reporting, so confidence is low. (Confidence: low · ASSESSED)

• I&W: Confirm: Investigators publish separate, evidence-based attributions for the Hormuz attacks and the East-West pipeline strike, or continue to report conflicting perpetrators for individual incidents. (0-14 days)
• I&W: Break: The IMO, US authorities or another independent investigation assigns the major shipping and pipeline attacks to one actor and provides corroborating evidence. (1-3 months)

4. Houthi forces are likely to maintain selective pressure on Saudi-linked shipping and energy infrastructure in the Red Sea over the next 14 days. The Houthis have been linked to a merchant-vessel attack that killed four seafarers, have advanced towards the Bab el-Mandeb, and have been reported as holding or approaching strategic coastal areas. China has asked Iran to restrain the Houthis, and US officials have met Houthi representatives in Oman. Confidence is medium because reporting conflicts over whether the Houthis already control the relevant coastal areas or remain in an advancing position. (Confidence: medium · ASSESSED)

• I&W: Confirm: A Houthi attack damages or seizes a Saudi-linked vessel, or strikes Saudi energy infrastructure near the Red Sea, Bab el-Mandeb or associated approaches. (0-14 days)
• I&W: Break: Independent reporting verifies Houthi withdrawal from the relevant coastal positions and records no attack on Saudi-linked shipping or energy infrastructure for 14 consecutive days. (0-14 days)

5. An immediate cessation of US-Iran hostilities is unlikely over the next 14 days, although diplomatic contact is likely to continue. Mohsen Rezaei says Tehran will not enter talks until its conditions are met, while Masoud Pezeshkian says Iran is ready for dialogue and Donald Trump has expressed openness to talks. Wang Yi has urged restraint and renewed negotiations, but a planned Iran-Gulf meeting in Salalah was cancelled after Houthi attacks. Confidence is medium because the statements are reliable as reports of official positions but conflict on policy and timing. (Confidence: medium · ASSESSED)

• I&W: Confirm: US and Iranian representatives hold a meeting with an agreed agenda, or both governments announce a verified pause covering strikes and maritime seizures. (0-14 days)
• I&W: Break: The United States conducts another strike against Iranian targets, Iran conducts another attack on US assets or shipping, or another planned diplomatic meeting is cancelled. (0-14 days)

6. Saudi Arabia is likely to restore about half of the East-West pipeline's capacity within days, but the pipeline disruption is likely to continue affecting Red Sea exports during the next 14 days. Saudi Arabia shut the pipeline after drone strikes and is seeking to restore roughly half its capacity, while it has sold Asian refiners more oil for collection outside the Strait of Hormuz. The restoration plan is supported by wire reporting, but there is no confirmed report that the target capacity has resumed, so confidence is medium. (Confidence: medium · ASSESSED)

• I&W: Confirm: Saudi authorities or operators report that roughly half of East-West pipeline capacity is flowing again and continue arranging crude collection outside the Strait of Hormuz. (0-14 days)
• I&W: Break: The pipeline remains offline beyond the stated restoration window, or additional damage to its pumping stations is reported. (0-14 days)

7. It is very likely that hackers compromised the networks of two foreign-flagged vessels bound for the United States, but it is unlikely that Iran's role in those incidents will be established within the next 14 days. The US Coast Guard and FBI boarded the vessels after receiving indications of network compromise, while the Coast Guard identified only unidentified foreign cyber actors. Media reports link the incidents to Iran, but the attribution remains under investigation and rests partly on unnamed sources. Confidence is medium. (Confidence: medium · ASSESSED)

• I&W: Confirm: The FBI or Coast Guard identifies additional compromised vessels, publishes technical evidence of intrusion, or links the incidents to an Iran-linked actor. (0-14 days)
• I&W: Break: Investigators conclude that the vessels' networks were not compromised, or publicly attribute the incidents to a non-Iranian actor on the basis of technical evidence. (0-14 days)

Outlook & scenarios

Prolonged exchanges and sustained maritime disruption (55%)

Likely scenario. US forces and Iran continue direct exchanges around the Strait of Hormuz, while attacks and attempted seizures keep merchant traffic well below the 2025 reference level. Saudi Arabia restores part of the East-West pipeline, but the Bab el-Mandeb remains exposed to Houthi pressure.

Limited diplomatic pause (30%)

A negotiated pause develops after continued US, Iranian and Chinese messaging, with a meeting involving US and Iranian representatives and a temporary reduction in attacks. Commercial shipping improves from the current disrupted level but does not return to normal within 14 days.

Red Sea route closure and wider regional escalation (15%)

Unlikely but high-impact scenario. Houthi forces consolidate positions overlooking the Bab el-Mandeb and conduct attacks that stop Saudi-linked shipping or energy movements in the southern Red Sea. The resulting pressure compounds the existing disruption in the Strait of Hormuz and prompts additional US or Saudi military action.

Maritime cyber incidents spread (20%)

Unlikely but high-impact scenario. Further foreign-flagged vessels bound for the United States report network intrusions, while investigators continue to examine an Iran link without reaching a public attribution. Boardings, diversions and insurance restrictions expand beyond the two vessels already investigated.

Recommendations

1. Maintain a daily fused maritime picture for the Strait of Hormuz and Bab el-Mandeb. Record verified attacks, vessel departures, flow estimates, stranded ships and named casualties separately from unverified attribution claims.
2. Treat responsibility for individual shipping and pipeline attacks as unconfirmed until US authorities, the IMO or an independent investigation provides technical or forensic support. Keep Iranian, Iraqi proxy and Houthi attribution as separate reporting lines.
3. Track Saudi East-West pipeline restoration against observable milestones: pumping-station status, confirmed pipeline throughput, crude collection outside the Strait of Hormuz and any renewed disruption to Red Sea exports.
4. Prioritise collection on Houthi positions along the Red Sea coast and approaches to the Bab el-Mandeb. Resolve whether the group controls strategic coastal areas or is still advancing, using independent maritime, imagery and local reporting.
5. Monitor the diplomatic positions of Donald Trump, Masoud Pezeshkian, Mohsen Rezaei and Wang Yi for concrete actions rather than statements. Treat an agreed agenda, an announced pause or a completed meeting as stronger indicators than public offers to negotiate.
6. Coordinate maritime cyber reporting with the US Coast Guard and FBI. Separate confirmed network compromise, suspected foreign involvement and Iran attribution, and track any additional vessel boardings or technical findings.

Confidence & uncertainty

Overall confidence is high for the existence and scale of the maritime disruption, the occurrence of recent US-Iran military exchanges and the official diplomatic positions. These judgements draw on IMO reporting, high-reliability wire coverage, major media, CENTCOM statements and US Coast Guard and FBI reporting. The main uncertainties concern responsibility for individual attacks, the extent of Houthi control near the Bab el-Mandeb, the timing of East-West pipeline restoration and Iran's role in the maritime cyber incidents.

Intelligence gaps

• [EEI 1.1 · PARTIAL] Concentrations or unusual movements of IRGC-Navy fast attack craft, small boat swarms, or escort vessels within 200 km of US/allied ships, including approach distances and formation changes. Recommended collection: maritime/AIS
• [EEI 1.2 · UNCOVERED] Detected pre-launch activity at coastal missile or rocket batteries (vehicle dispersal, fuel/warhead handling, radars powering up, transport erector launchers moving to firing positions). Recommended collection: imagery/signals
• [EEI 1.3 · UNCOVERED] Increased launch/arming/positioning of armed UAVs (MALE/loitering munitions) or tactical aircraft at Iranian coastal bases with sortie generation rates and munitions loadouts. Recommended collection: air/ADS-B/imagery
• [EEI 1.4 · UNCOVERED] Command-and-control indications of attack orders or elevated rules-of-engagement from IRGC/General Staff (intercepted communications, internal order messages, force-wide alert messages). Recommended collection: signals/human
• [EEI 2.2 · UNCOVERED] Issuance of formal orders, mobilization directives, travel restrictions, or official internal communications within IRGC/Armed Forces indicating escalation posture or stand-down. Recommended collection: human/diplomatic
• [EEI 2.3 · PARTIAL] Directives, logistics movements, or communications from Iranian commanders to regional proxy militias (Houthis, Iraqi Shia militias, Lebanese groups) that change their threat posture or task them with specific operations. Recommended collection: signals/human
• [EEI 3.2 · UNCOVERED] Discovery or reporting of naval mines, unexploded ordnance, or damage to fixed maritime infrastructure (oil platforms, terminals, pipelines) with geolocated imagery or on-scene assessments. Recommended collection: imagery/open-source
• [EEI 3.4 · PARTIAL] Movements or posture changes of regional state navies/air forces (Saudi, UAE, Kuwait, Bahrain, UK) such as task group departures, airbase dispersals, or announced maritime patrols near choke points. Recommended collection: open-source/imagery

Cited sources

[1] The Soufan Center · Iran War Solution Nowhere in Sight as U.S. and Iran Remain Entrenched (C) · Thu Sep 17 2026 04:00:44 GMT+0000 (Coordinated Universal Time) · sha256:00d5acc065c9 [2] i24NEWS · i24NEWS - Breaking news from the Middle East, Israel and around the world (B) · Thu Sep 17 2026 20:04:38 GMT+0000 (Coordinated Universal Time) · sha256:b9789f2a7ecc [3] Manara Magazine · The Boomerang Effect: How the Iran War May Reshape the Balance of Power Washington Spent Two Decades Trying to Rebuild (C) · Fri Sep 18 2026 00:12:39 GMT+0000 (Coordinated Universal Time) · sha256:4b5aacfa9909 [4] Quincy Institute · From Strategic Patience to Persistent Counter-Escalation: Iran’s Emerging Theory of Deterrence (C) · Thu Sep 17 2026 14:00:00 GMT+0000 (Coordinated Universal Time) · sha256:9e63092fe736 [5] gCaptain · IMO Sounds Alarm as Attacks on Merchant Ships Spread Across Global Trade Routes (C) · Thu Sep 17 2026 18:01:47 GMT+0000 (Coordinated Universal Time) · sha256:43878ecd9b88 [6] Bloomberg (republished by gCaptain) · Oil Extends Drop as Saudi Arabia Moves to Restore Vital Pipeline (A) · Thu Sep 17 2026 12:52:54 GMT+0000 (Coordinated Universal Time) · sha256:9b5462bb73bd [7] CBS News · House speaker declares Iran nuclear issue "taken care of" (A) · Mon Sep 14 2026 08:04:00 GMT+0000 (Coordinated Universal Time) · sha256:ee82066c003b [8] Armenian Weekly · The Region in Brief (D) · Thu Sep 17 2026 15:11:12 GMT+0000 (Coordinated Universal Time) · sha256:819865bdd35d [9] Reuters (republished by gCaptain) · Authorities Investigating Cyber Breaches Aboard Two U.S.-Bound Ships (A) · Thu Sep 17 2026 21:36:57 GMT+0000 (Coordinated Universal Time) · sha256:adc4f90380e1 [10] ABC World News Tonight with David Muir (via Facebook) · Newly released video shows the FBI and Coast Guard forces boarding two U.S.-bound oil tankers that were hit by massive cyberattacks. The U.S. is now urgently investigating whether Iran played a role. Pierre Thomas has the latest. https://abcnews.link/Dhbaq6H | ABC World News Tonight with David Muir (E) · sha256:4f42e9c59f74

Source content hashes were computed at collection time; the cited text is preserved unmodified for the life of this product.

TLP:CLEAR