Will HMS Networks PCAN Windows driver CVEs be actively exploited by Dec 2026?

CISA alert documents four CVEs (CVE-2026-109576, CVE-2026-101103, CVE-2026-94188, CVE-2026-103672) in HMS Networks PEAK-System PCAN Windows drivers ≤5.1.2.1151 that could crash the Windows kernel. These drivers are used in industrial and automotive OT environments.

Resolution Criteria

Exploitation confirmed by: (1) vendor advisory or security researchers documenting active exploitation, (2) CISA KEV addition with exploitation evidence, (3) public PoC demonstrating kernel crash on vulnerable versions, or (4) incident reports from security firms.