Security readout for executives and security teams
Plain-English summary
CVE-2026-49316 affects the 2025 Indian Motorcycle Scout Bobber + Tech. A nearby attacker with access to the motorcycle’s in-vehicle network could make a control module stop sending anti-theft shutdown messages, allowing operation despite the immobilizer not being unlocked. Public sources do not name a patch or active exploitation.
Executive priority
Treat as a moderate physical-security risk for affected motorcycles. Prioritize awareness, vendor follow-up, and compensating theft-prevention measures until Indian Motorcycle publishes remediation or clarification.
Technical view
The issue is an expected-behavior violation in the vehicle CAN network. Forcing the Wireless Control Module into a CAN bus-off state stops WCM transmissions, including shutdown commands. Peer ECUs reportedly treat WCM silence as normal, so operation continues. Specific protocol details are withheld pending vendor remediation.
Likely exposure
Exposure appears limited to 2025 Indian Motorcycle Scout Bobber + Tech units where an attacker can physically or adjacently access the in-vehicle network. No other affected models are named in the provided sources.
Exploitation context
The CVE requires adjacent-network or physical proximity conditions and no privileges or user interaction. The record is not listed as KEV, and the provided sources do not report active exploitation. The impact is primarily anti-theft bypass and availability/security-control failure.
Researcher notes
The public record withholds protocol specifics pending remediation. Analysis should stay within authorized lab conditions. The cited CWEs indicate expected behavior violation, protection mechanism failure, and improper handling of exceptional conditions. Evidence is incomplete on patch availability and exploitation in the wild.
Mitigation direction
- Check Indian Motorcycle or dealer guidance for remediation status.
- Limit unattended access to affected motorcycles where feasible.
- Inspect for aftermarket devices or exposed wiring that could increase CAN access.
- Track CVE updates for vendor fixes or service campaigns.
- Avoid relying solely on the immobilizer for theft prevention.
Validation and detection
- Inventory 2025 Scout Bobber + Tech assets in scope.
- Confirm model year and trim against ownership or service records.
- Review CVE and vendor channels for updated affected-version details.
- Ask authorized service channels about WCM or anti-theft updates.
- Do not perform CAN fault testing on production motorcycles without vendor-approved procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-440: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-693: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-754: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-49316 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H0.93.6ASRGCVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——ASRGVulnerability scoring details
Base CVSS 4.0 score
4.1MediumVector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
4.6MediumVector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineASRG
Reported to Indian Motorcycle by Rustic Security LLC (responsible disclosure)
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cwe.mitre.org/data/definitions/440.htmlCVE reference, ASRG · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.