Is CVE-2026-86689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86689 being exploited in the wild.

How severe is CVE-2026-86689?

Medium severity, with a CVSS score of 5.9, published 18 September 2026.

Which products and versions are affected?

Bransys ELD Android < 11.00.00; iOS < 1.1.54.

Is there a fix for CVE-2026-86689?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86689?

Check whether you run Bransys ELD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86689: Bransys ELD cleartext transmission of sensitive information in MQTT

Q: Which products and versions are affected?

Bransys ELD Android < 11.00.00; iOS < 1.1.54.

Q: Is there a fix for CVE-2026-86689?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-86689 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-86689?

Check whether you run Bransys ELD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86689 · Severity: medium · CVSS 5.9 · Published 2026-09-18

Bransys ELD is a fleet management application for electronic logging devices used by transportation carriers. The app transmits sensitive telemetry data over MQTT without encryption, allowing attackers with network access to intercept real-time location and operational data for all connected vehicles. An attacker can read all telemetry from any device connected to the affected MQTT broker without authentication.

Technologies: Bransys ELD. Vendors: Bransys.

Quick answers

Is CVE-2026-86689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86689 being exploited in the wild.
How severe is CVE-2026-86689?: Medium severity, with a CVSS score of 5.9, published 18 September 2026.
Which products and versions are affected?: Bransys ELD Android < 11.00.00; iOS < 1.1.54.
Is there a fix for CVE-2026-86689?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86689?: Check whether you run Bransys ELD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-86689 affects the MQTT communication channel used by Bransys ELD to transmit device telemetry. The vulnerability involves cleartext transmission of sensitive information over the network without TLS encryption (CWE-319). An unauthenticated, network-based attacker can passively eavesdrop on or actively connect to the MQTT broker to read all sensitive telemetry data from affected devices; no user interaction or authentication is required.

Affected products

Bransys ELD Android < 11.00.00; iOS < 1.1.54

Timeline

2026-09-17: disclosed
2026-09-18: advisory: CISA ICS Advisory ICSA-26-260-01 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.