“Rampant targeting of OEMs via supply chains risks fuelling the automotive threat landscape further. Manual defences are no longer sufficient, the industry needs active resilience with focus on software composition analysis (SCA) if it’s to secure the era of software-defined vehicles.” – Vlad Ryabyshkin, Chief Technology Officer, PCA Cyber Security
PCA Cyber Security’s Q2 2026 Global Automotive Threat Intelligence Report finds 345 unique automotive vulnerabilities discovered in the quarter, with high-severity flaws more than doubling to 161. Researchers and threat actors are increasingly targeting fleets, supply chains, and cloud backends rather than individual vehicles with AI decreasing time to exploit among automotive vulnerabilities.
Budapest, Hungary – 29 July, 2026 – PCA Cyber Security, the embedded cybersecurity expert company, today warns that high-risk automotive security vulnerabilities are being discovered quicker than ever.
PCA’s latest Global Automotive Threat Intelligence Report reveals that 161 of the 345 unique automotive vulnerabilities discovered in Q2 were classed as high-severity, more than double the 75 uncovered in Q1. In the automotive industry, a high-severity vulnerability is a significant software or hardware flaw that can be actively exploited to gain control over substantial vehicle functions, access sensitive personal data or compromise driver privacy. Under ISO/SAE 21434 standards, such vulnerabilities pose risks that must be mitigated to stay compliant.
94% of new vulnerabilities have low attack complexity
Fourteen entry methods for vehicle hacking are seen across Q2’s automotive vulnerabilities, but a small handful account for most exposure. Local Shell was the most frequent point of entry, making up 28% of all vulnerabilities. Local Shell describes a method to gain command-line access to a vehicle’s onboard computer to extract data or compromise critical systems, often via misuse of diagnostic and debug interfaces. Almost all (94%) of automotive vulnerabilities discovered in Q2 present a low attack complexity, meaning they can be exploited without specialised tooling or lengthy threat actor preparation.
OEMs are coming under attack
This shift comes as researchers and cyber criminals alike increasingly use AI to speed up the discovery and exploitation of automotive vulnerabilities. In Q2, PCA’s report highlights that this use of AI is trending towards attack methods with a blast radius beyond single vehicles, including:
White hat research demonstrated how rentable EV chargers and shared e-bikes and e-scooters can be tampered with remotely by hacking cloud-based authentication systems, opening the door to disabling city-wide infrastructure.
A mid-April ransomware incident targeting a UK-based automotive data and vehicle valuation provider saw dealers, insurers, and OEMs suffer a regional valuation “blackout” with access to key data cut off.
Separate white hat research showed how unencrypted data from a car head unit bought second-hand can be used to trace the previous owner’s car history and expose personal data.
Large Japanese automotive components manufacturer breached via suppliers
PCA’s monitoring of cybercriminal forums, dark-web marketplaces, and ransomware leak sites over Q2 reveals key trends and shifts in the tactics, techniques, and procedures of threat actors targeting the automotive industry. A critical insight is that leaks through automotive supply chains are on the rise, and leaks of intellectual property are becoming a more acute pain point for the industry. In Q2, PCA observed:
The Qilin ransomware operation listed one of the world’s largest Japanese automotive components manufacturers as a breached victim, with the compromise centred on European and North African subsidiaries rather than the parent’s core Japanese network.
An emerging extortion group claimed a Canadian regional automotive parts retailer and distributor on its leak site, asserting it had exfiltrated sensitive data and would publish it unless paid.
The “World Leaks” extortion group published more than 630 GB of data, over 200,000 files, stolen from a major Indian electronics contract manufacturer, including confidential engineering documents belonging to one of the world’s largest EV manufacturers.
To manage the jump in vulnerability volume and severity, PCA Cyber Security stresses the need for the automotive industry to evolve from tracking CVEs to verifying patch presence across the full software bill of materials (SBOM).
Media Contact
Company Name: PCA Cyber Security
Contact Person: Laura Martisiute
Email: Send Email
Country: Hungary
Website: https://pcacybersecurity.com
