CVE-2026-49325 MEDIUM

CVE-2026-49325: Indian Scout Bobber 2025 WCM voltage-based shutdown

Vendor Indian Motorcycle (Polaris Inc.)
Product Scout Bobber + Tech
Weakness CWE-1384
Published May 29, 2026
Last update May 29, 2026

CVSS base score

4.6/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows a physical attacker with access to the Wireless Control Module (WCM) wiring harness to bypass the anti-theft shutdown. The WCM signals shutdown to a peer ECU via a falling-edge voltage transition on a dedicated wire pair. The receiving ECU does not distinguish between an active shutdown pulse and an open-circuit / disconnected condition; interrupting the relevant wires leaves the motorcycle fully operable even though the WCM never validated the rider's PIN. Specific connector details have been withheld pending vendor remediation.

Key dates

02Disclosure timeline

May 29, 2026 CVE published
May 29, 2026 Record updated