Quick answers
- Is CVE-2026-49318 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49318 being exploited in the wild.
- How severe is CVE-2026-49318?
- Low severity, with a CVSS score of 2.4, published 29 May 2026.
- Which products and versions are affected?
- Indian Motorcycle Scout Bobber 2025 model year.
- Is there a fix for CVE-2026-49318?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49318 attacked?
- It is attacked with physical access.
- Am I affected by CVE-2026-49318?
- Check whether you run Indian Motorcycle Scout Bobber at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is caused by an incorrect behavior order and improper check for exceptional conditions during the infotainment system's boot sequence. The system uses the presence of Wireless Control Module (WCM) traffic on the CAN bus as a proxy to determine if an immobilizer is installed; if no traffic is detected during the boot window, the system assumes no immobilizer is present and fails open, skipping the PIN entry screen. An attacker with physical access can exploit this by silencing the WCM (e.g., via a CAN bus-off attack) during startup to present a fully unlocked interface. Specific protocol and timing details are currently withheld by the vendor.
Affected products
- Indian Motorcycle Scout Bobber + Tech 2025 model year
Timeline
- 2026-05-29: disclosed: Initial disclosure by ASRG
- 2026-05-29: advisory: NVD publication date