The Cybersecurity and Infrastructure Security Agency has warned that three vulnerabilities in Bendix EC80 Brake electronic control units could let an attacker disrupt several vehicle safety and control functions. The affected equipment is used in transportation systems, with deployments identified in the United States and Canada.

CVE-2026-67560 has the advisory’s highest listed CVSS scores. The flaw is a stack-based buffer overflow that may allow an attacker to crash the ECU. CISA says a crafted payload could then support remote execution of arbitrary code or injection of arbitrary traffic onto the controller area network, or CAN bus. Potential effects include loss of antilock braking, steering assist, the speedometer and shifting capabilities.

The advisory assigns CVE-2026-67560 a CVSS 3.1 base score of 7.5 and a CVSS 4.0 score of 7.7, both in the high-severity range. Its scoring vectors describe an attack requiring adjacent network access, high attack complexity and no privileges or user interaction. The advisory does not describe a successful exploitation incident.

A second vulnerability, CVE-2026-68967, is an out-of-bounds write. CISA says an attacker could deliver a payload that establishes an arbitrary write primitive and crashes the ECU. The issue carries a CVSS 3.1 score of 6.5, rated medium, and a CVSS 4.0 score of 7.1, rated high. Its listed attack conditions require adjacent access but lower attack complexity than the buffer overflow, with no privileges or user interaction required.

The third issue, CVE-2026-71396, involves hard-coded credentials in the affected product. CISA says exploitation could allow an attacker to disable automatic traction control. The vulnerability has CVSS 3.1 and CVSS 4.0 scores of 5.4 and 5.3, respectively, both classified as medium. The advisory identifies the weaknesses as CWE-121, stack-based buffer overflow; CWE-787, out-of-bounds write; and CWE-798, use of hard-coded credentials.

The affected configurations span multiple EC80ESP and EC80ESP+ variants. They include EC80ESP+ models using J1708, 6S/6M, PLC, second CAN and integrated TPMS configurations, all listed at version Z228999. Affected EC80ESP models include 6S/6M, PLC, second CAN and CAN Gateway configurations at Z266494, along with 4S/4M and PLC configurations at Z286098. CISA marks each listed product version as known affected.

Bendix’s prescribed remediation is a firmware update. Users of the EC80ESP+ configurations at Z228999 should update to firmware Z300822. EC80ESP configurations at Z266494 should be updated to Z302578, while the EC80ESP 4S/4M and PLC configurations at Z286098 should be updated to Z302579. Bendix also recommends that users install the most recent firmware releases and contact the company at [email protected] for additional assistance.

CISA separately recommends reducing network exposure for control-system devices and ensuring they are not accessible from the internet. Its guidance calls for placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is necessary, CISA recommends more secure methods such as updated virtual private networks, while noting that connected devices also affect VPN security.

Ben Gardiner of NMFTA reported the vulnerabilities to CISA, the advisory says. Organizations that observe suspected malicious activity are directed to follow their internal procedures and report findings to CISA for tracking and correlation. The immediate remediation path identified in the advisory is to apply the firmware versions specified for each affected EC80 configuration.