CISA warns of Bendix EC80 brake ECU flaws that could affect vehicle functions

By Atlas Watchline Staff · Regulatory · August 25, 2026

CISA says three vulnerabilities in Bendix EC80 Brake ECU products could disrupt braking-related vehicle functions, and Bendix has firmware updates available for affected versions.

CISA on Aug. 25 issued an advisory on three vulnerabilities in Bendix EC80 Brake ECU products that could affect braking-related vehicle functions, including ABS, steering assist, the speedometer, shifting capabilities and automatic traction control.

CISA said the affected devices are used in transportation systems and are deployed in the United States and Canada. The agency said no known public exploitation specifically targeting these vulnerabilities had been reported to it at the time of publication.

The advisory, identified as ICSA-26-237-05, lists three CVEs. CISA described CVE-2026-67560 as a stack-based buffer overflow that may let an attacker crash the ECU. The agency said a crafted payload could then allow remote execution of arbitrary code or injection of arbitrary CAN bus traffic, which could lead to loss of ABS function, steering assist, speedometer and shifting. CISA rated the issue 7.5 under CVSS 3.1 and 7.7 under CVSS 4.0.

CISA described CVE-2026-68967 as an out-of-bounds write that could let an attacker deliver a payload creating an arbitrary write primitive and crashing the ECU. The agency rated that issue 6.5 under CVSS 3.1 and 7.1 under CVSS 4.0.

The third issue, CVE-2026-71396, involves hard-coded credentials. CISA said it could allow an attacker to disable automatic traction control. The agency rated it 5.4 under CVSS 3.1 and 5.3 under CVSS 4.0.

CISA said the affected Bendix EC80 Brake ECU product family includes EC80ESP+ J1708 Z228999, EC80ESP+ 6S/6M Z228999, EC80ESP+ PLC Z228999, EC80ESP+ 2nd CAN Z228999 and EC80ESP+ Integrated TPMS Z228999, among other listed versions. The advisory lists the versions as known_affected.

For the Z228999 line, CISA said Bendix recommends updating to Z300822. For EC80ESP 6S/6M Z266494, EC80ESP PLC Z266494, EC80ESP 2nd CAN Z266494 and EC80ESP CAN Gateway Z266494, the recommended update is Z302578. For EC80ESP 4S/4M Z286098 and EC80ESP PLC Z286098, the recommended update is Z302579.

CISA said the vulnerabilities were reported by Ben Gardiner of NMFTA. The advisory also lists recommended steps such as reducing network exposure, placing control system networks behind firewalls, using VPNs carefully and keeping them updated, and performing impact analysis before deploying defensive measures.

Users who need help can contact Bendix at info@Bendix.com, according to the advisory.

Operators with the affected Bendix firmware versions can review the advisory, compare installed versions with the update list and apply the most recent Bendix releases.

Sources

• CISA Cybersecurity Advisory ICSA-26-237-05

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.