Is CVE-2026-49319 actively exploited?

No active exploitation of CVE-2026-49319 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49319 be exploited remotely?

Partially. CVE-2026-49319 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-49319?

CVE-2026-49319 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-49319

MEDIUM

CVE-2026-49319

CWE-294Published: June 25, 2026· Updated: Jun 26, 2026

6.5

CVSS v3.1

EPSS:0.24%probability of exploitation in 30 daysPercentile:15.0th

Official Description

Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication.

An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).

NVD Source

Technical Analysis

CVE-2026-49319 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.