CVE-2026-67560

CVE-2026-67560 is a stack-based buffer overflow (CWE-121) in the Bendix EC80 Brake ECU, an electronic control unit used in commercial vehicle braking systems. An attacker with access to the vehicle's adjacent network (the vehicle CAN bus) can send a crafted payload that, despite high attack complexity, crashes the ECU and can then be extended to execute arbitrary code or inject arbitrary CAN bus traffic. Successful exploitation could disable safety-relevant functions including ABS braking, steering assist, the speedometer, and shifting. Operators of commercial tractors and trailers fitted with Bendix EC80 units are potentially affected. No public proof-of-concept, known in-the-wild exploitation, or KEV listing exists; EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Identify which fleet vehicles (tractors and trailers) are fitted with Bendix EC80 ECUs and check the CISA ICS-CERT/Bendix advisory for fixed firmware, applying updates through authorized Bendix service channels. Until updated, limit access to the vehicle CAN bus from untrusted or aftermarket devices (telematics units, diagnostic adapters) and investigate unexpected ABS, steering-assist, or speedometer faults promptly. No exploitation is currently known, so routine CAN traffic monitoring is a reasonable precaution rather than an urgent action.