Every commercial truck on a US road has to log its driver's hours electronically, and plenty of fleets do that with software they bought under their own brand from somebody else. One of those suppliers is Bransys, and CISA said on September 17 that the Bransys electronic logging apps ship with their passwords written into the code.
The headline flaw is CVE-2026-86520, which CISA rates 7.5 out of 10 on the CVSS 3.1 scale and 8.7 on the newer 4.0 scale. The advisory is specific about what the credentials unlock: hardcoded MQTT credentials that "will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker". MQTT is the lightweight messaging protocol fleet hardware uses to stream telemetry back to a server, so one set of shipped-in credentials covers whatever every connected unit is reporting, across more than one company's fleet.
Two more credentials and a plaintext channel
Two further issues ride along. CVE-2026-77960 is a second set of hardcoded credentials, this time for FTP, which CISA says could let an attacker connect to the server and read data; it scores 5.3 under CVSS 3.1 and 6.9 under 4.0. CVE-2026-86689 covers cleartext transmission of sensitive information, meaning an attacker who can reach the broker can read everything crossing it. That one scores 5.9 under CVSS 3.1 and 8.2 under 4.0, and its vector marks the attack as harder to pull off than the hardcoded credential path.
Read access, not remote control
All three vectors CISA published describe a loss of confidentiality only, with no impact on integrity or availability. Nobody is steering a truck through this. What is exposed is the data an electronic logging device produces, which is the record US rules require a carrier to keep of driving hours and mileage, and CISA describes the impact as unauthorized access to telemetry data and firmware without enumerating the individual fields. The agency also says no public exploitation targeting these flaws has been reported to it.
Update through the app store, and mind the branding
The fix is an ordinary app update. Android users need version 11.00.00 or newer and iOS users need 1.1.54 or newer, both through the app store. Bransys sells the platform as a private label product, so the app a driver actually has installed may carry a fleet's own name rather than the vendor's, and an operator checking exposure should look at the build number they are distributing rather than search the stores for Bransys. CISA's standing advice bites harder than usual here, because a credential compiled into a shipped binary is not something a customer can rotate: keep these systems off the open internet, put them behind a firewall, and use a VPN where remote access is genuinely needed.
Jaime Lightfoot reported the three flaws to CISA, which published them as advisory ICSA-26-260-01, one of seven industrial advisories the agency released that day. Credentials baked into transport software keep surfacing: two days earlier CISA flagged cryptographic keys hardcoded into Wartsila software running on ships. The pattern is the same each time, and so is the awkward part of it. A password in source code is not a setting anyone can change, so the only lever the operator holds is the update.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.