CVE-2026-49316 describes an expected behavior violation in the in-vehicle network of the 2025 Indian Motorcycle Scout Bobber + Tech. An attacker on an adjacent network can exploit a CAN error-frame injection technique targeting periodic WCM transmissions to drive the WCM's CAN controller transmit error counter beyond the bus-off threshold. This causes the WCM to cease all message transmissions, including the anti-theft shutdown command. Since peer ECUs do not treat the WCM's silence as a security event, they continue normal operation, allowing the motorcycle to be operated without unlocking the immobilizer. Specific protocol details are withheld pending vendor remediation. No patch or fix information is currently available.

The vulnerability allows an attacker with adjacent network access to bypass the motorcycle's anti-theft mechanism by disabling the Wireless Control Module's transmissions. This results in the motorcycle being operable despite the immobilizer not being unlocked, effectively defeating the anti-theft protection. There is no impact on confidentiality or integrity reported, but availability is affected as the WCM stops transmitting. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, no specific mitigation steps are provided. Monitoring vendor communications for updates is recommended.