Is CVE-2026-18268 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18268 being exploited in the wild.

How severe is CVE-2026-18268?

High severity, with a CVSS score of 7, published 20 August 2026.

Which products and versions are affected?

Kenwood DNR1007XR prior to firmware version 2020F (2026-07-29 patch).

Is there a fix for CVE-2026-18268?

A patch was published on 2026-07-29: Firmware update released (Version 2020F or later) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18268 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-18268?

Check whether you run Kenwood DNR1007XR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18268: Kenwood DNR1007XR JKGenService command injection local privilege escalation

CVE-2026-18268 · Severity: high · CVSS 7 · Published 2026-08-20

The Kenwood DNR1007XR is a car navigation and multimedia receiver used in vehicles. A command injection flaw in the JKGenService component allows a local attacker who can already run code on the device to escalate privileges and execute arbitrary commands with root access, compromising vehicle safety systems and infotainment functionality.

Technologies: Kenwood DNR1007XR. Vendors: Kenwood.

Quick answers

Is CVE-2026-18268 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18268 being exploited in the wild.
How severe is CVE-2026-18268?: High severity, with a CVSS score of 7, published 20 August 2026.
Which products and versions are affected?: Kenwood DNR1007XR prior to firmware version 2020F (2026-07-29 patch).
Is there a fix for CVE-2026-18268?: A patch was published on 2026-07-29: Firmware update released (Version 2020F or later) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18268 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-18268?: Check whether you run Kenwood DNR1007XR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a command injection flaw in the JKGenService component of the Kenwood DNR1007XR in-vehicle multimedia receiver. The vulnerability stems from insufficient validation of user-supplied input before passing it to a system call, allowing an attacker to inject arbitrary commands. Exploitation requires prior local code execution with at least low-privilege access on the target device. A successful exploit enables an attacker to escalate privileges and execute arbitrary code with root-level permissions. The CVE CVSS score of 7.0 reflects the high impact (confidentiality, integrity, availability) combined with the requirement for local access and low-privilege starting context. Kenwood released a firmware patch as of 2026-07-29 to address this issue.

Affected products

Kenwood DNR1007XR prior to firmware version 2020F (2026-07-29 patch)

Timeline

2026-02-03: disclosed: Vulnerability reported to vendor
2026-07-29: advisory: Coordinated public disclosure via ZDI-26-485
2026-07-29: patched: Firmware update released (Version 2020F or later)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.