High severity8.1NVD Advisory· Published Aug 5, 2026· Updated Sep 8, 2026

CVE-2026-18411

Description

The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

KARR Security System/KARR Security Systemllm-create
SWDS/SWDS dealer-installed automotive anti-theft systemsllm-create

Patches

Vulnerability mechanics

References

www.cisa.gov/news-events/ics-advisories/icsa-26-216-01nvd

News mentions

Acrisure KARR BT and DR-100
CISA ICS Advisories

Severity

HighCVSS v3.1

8.1/ 10

CVSS v47.2

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Adjacent
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

0.21%

VYPR risk score

Composite of severity, exploitation, and reach.

0.53high

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-321
Use of Hard-coded Cryptographic Key

CVE ID

CVE-2026-18411

Credits

AS
Aaron Schulman, Jerry Yu, Yibo Wei, Sumanth Rao, Mohak Vaswani, Jefferson Chien, Christian Dameff, and Nishant Bhaskar of UC San Diego team discovered this vulnerability.
finder