Quick answers
- Is CVE-2026-18283 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18283 being exploited in the wild.
- How severe is CVE-2026-18283?
- Low severity, with a CVSS score of 2.4, published 20 August 2026.
- Which products and versions are affected?
- Sony XAV-9500ES.
- Is there a fix for CVE-2026-18283?
- A patch was published on 2026-07-29: Sony issued software update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18283 attacked?
- It is attacked with physical access, in a network appliance.
- Am I affected by CVE-2026-18283?
- Check whether you run Sony XAV-9500ES. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an authorization bypass affecting the udev rules configuration on the Sony XAV-9500ES. The root cause is improper validation of USB device types, allowing a crafted USB device to trigger instantiation of otherwise restricted USB device categories. The attack vector is physical: an attacker must connect a malicious USB device to the vehicle's head unit. No authentication or user interaction is required. An attacker can leverage this to circumvent authorization controls and access restricted functionality. Sony has released a software update to address this issue.
Affected products
- Sony XAV-9500ES
Timeline
- 2026-03-19: disclosed: Vulnerability reported to vendor
- 2026-07-29: advisory: Coordinated public release
- 2026-07-29: patched: Sony issued software update