CVE WatchJul 21, 2026

CVE-2026-49325

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a

CVSS

4.6

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: May 29, 2026 · Last modified: Jul 21, 2026 · CWE-693 · CWE-754 · CWE-1384

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-032026-07-31

Technical description

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.

Official references

cwe.mitre.orghttps://cwe.mitre.org/data/definitions/1384.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-180159.6 CRI

8.5%

——3Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)2d CVE-2026-179434.3 MED

10.5%

——3Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)2d CVE-2026-179366.5 MED

4.8%

——1Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)2d CVE-2026-179316.5 MED

14.3%

——4Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)2d CVE-2026-179236.5 MED

12.0%

——4Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chromium security severity: Low)2d CVE-2026-179196.8 MED

1.3%

——0Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)2d