Is CVE-2026-86520 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86520 being exploited in the wild.

How severe is CVE-2026-86520?

High severity, with a CVSS score of 7.5, published 18 September 2026.

Is there a fix for CVE-2026-86520?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86520 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-86520?

Check whether you run Bransys ELD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86520: Bransys ELD hardcoded credentials and cleartext transmission

CVE-2026-86520 · Severity: high · CVSS 7.5 · Published 2026-09-18

Bransys ELD is a fleet management application used in transportation to track vehicle telemetry and operational data. The application contains hardcoded credentials for MQTT and FTP services, and transmits sensitive information in cleartext. An attacker can exploit these weaknesses to gain unauthorized access to real-time vehicle data and firmware across multiple carriers without authentication.

Technologies: Bransys ELD. Vendors: Bransys.

Quick answers

Is CVE-2026-86520 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86520 being exploited in the wild.
How severe is CVE-2026-86520?: High severity, with a CVSS score of 7.5, published 18 September 2026.
Which products and versions are affected?: Bransys ELD <11.00.00.
Is there a fix for CVE-2026-86520?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86520 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-86520?: Check whether you run Bransys ELD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from three distinct weaknesses in Bransys ELD versions for Android and iOS. CVE-2026-86520 involves hardcoded MQTT credentials shipped with the application, allowing attackers to authenticate to the MQTT broker and read real-time telemetry data for all connected devices without any credentials. CVE-2026-86689 results from cleartext transmission of sensitive information, enabling attackers on the network path to intercept and read all broker communications. CVE-2026-77960 involves hardcoded FTP credentials embedded in the application, permitting unauthenticated FTP server access. All three vulnerabilities require only network access and no user interaction. Bransys has released patches (Android 11.00.00 and later, iOS 1.1.54 and later) that should be installed immediately through the respective app stores.

Affected products

Bransys ELD Android <11.00.00
Bransys ELD iOS <1.1.54

Identifiers

CVE-2026-86520
CVE-2026-77960
CVE-2026-86689

Timeline

2026-09-17: advisory: CISA advisory ICSA-26-260-01 published

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-01

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.