The electronic control unit that manages the brakes on a commercial truck is not the sort of computer most people think about. On August 25 the US Cybersecurity and Infrastructure Security Agency published an advisory saying that the Bendix EC80 brake ECU carries three vulnerabilities, and that exploiting them could cause the loss of anti-lock braking, steering assist, the speedometer and gear shifting, or switch off automatic traction control.
That reads alarmingly, so the access requirement matters. CISA's scoring puts the worst of the three, a stack-based buffer overflow tracked as CVE-2026-67560, at 7.5 with an attack vector of adjacent network. In plain terms, somebody has to already be on the vehicle's own network to send the crafted payload that crashes the ECU and, from there, execute code or inject arbitrary CAN bus traffic. This is not a flaw anyone reaches from the internet. It is a flaw that matters once telematics units, aftermarket dongles or a workshop laptop are in the picture.
The other two are an out-of-bounds write (CVE-2026-68967, rated 6.5, an arbitrary write primitive that can crash the ECU) and hard-coded credentials (CVE-2026-71396) that could let an attacker disable automatic traction control. Eleven part number variants across the EC80ESP and EC80ESP+ families are listed as affected, deployed in the United States and Canada.
A transponder nobody will patch
The second transportation advisory of the day has no fix coming at all. The FURUNO FA-50 Class B AIS transponder, the box a vessel uses to broadcast its identity and position to other ships and to shore, is affected in every version by hard-coded credentials (CVE-2026-59769, rated 9.1) and by a management screen where some settings can be changed with no authentication at all (CVE-2026-67578, rated 7.5). Both let an attacker on the in-vessel network alter the device's settings.
FURUNO Electric notes that production ended in October 2020 and that software updates will no longer be provided. Its guidance is physical and procedural rather than technical: do not connect the product directly to the internet, and keep the vessel it is installed on properly locked and managed. Souvik Kandar reported both issues to CISA, with JPCERT/CC coordinating between Furuno and the agency.
The highest score went to a factory gateway
The day's most severe rating was not in transport. Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed do not enforce authentication on the Node-RED HTTP interface, which leaves programming nodes capable of running system commands open to anyone who can reach them. Tracked as CVE-2026-58115 and rated a full 10.0, it affects all versions below V4.3.4.1. The remaining four advisories cover Zoneminder (rated 8.8, remote code execution as the web server user, in versions 1.37.48 and 1.38.3), the Rently Smart Home platform up to 20.1.0 (rated 8.1), the PayRange API, and the Ebyte NE2-D11 serial server, which alone accounts for eleven CVEs.
CISA says it has received no reports of public exploitation specifically targeting the transportation flaws. That is a snapshot, not a guarantee, and it sits alongside our earlier reporting that industrial attacks aimed at physical damage are rising.
Update the firmware, or wall the device off
Bendix operators should move EC80ESP+ units on Z228999 to firmware Z300822, EC80ESP units on Z266494 to Z302578, and EC80ESP units on Z286098 to Z302579, per the advisory. Siemens users should update past V4.3.4.1. For the FURUNO transponder there is nothing to install, so the control is network isolation and physical access. CISA's standard advice applies to all seven: keep control system devices off the internet, put them behind firewalls, and separate them from business networks.
The pattern in this batch is worth sitting with. A brake controller and a ship transponder are both long-lived hardware bought once and expected to work for a decade or more, which is precisely the timescale on which a vendor stops shipping updates, as the Haiwell gateway flaw illustrated earlier this month. The vulnerability disclosure keeps arriving on software time. The equipment does not.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.