What’s Vulnerable › Vulnerabilities

CVE-2026-67560: Stack-based Buffer Overflow in Bendix EC80 Brake ECU

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-03
• Weakness: CWE-121

Description

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

Affected products

• Bendix EC80ESP+ 2nd CAN: Z228999
• Bendix EC80ESP+ 6S/6M: Z228999
• Bendix EC80ESP+ Integrated TPMS: Z228999
• Bendix EC80ESP+ J1708: Z228999
• Bendix EC80ESP+ PLC: Z228999
• Bendix EC80ESP 2nd CAN: Z266494
• Bendix EC80ESP 4S/4M: Z286098
• Bendix EC80ESP 6S/6M: Z266494
• Bendix EC80ESP CAN Gateway: Z266494
• Bendix EC80ESP PLC: Z266494, Z286098

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-05.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-05

Get alerted when CVE-2026-67560 or the next vulnerability affects your stack