Q3 2026 Highlights 

• VicOne observed 400 automotive cybersecurity incidents in Q3 2026, down 16.1% from 477 in Q2. The Americas remained the most affected region with 184 incidents, while Asia increased 36.8% to 93 
• In-vehicle systems became the most affected domain. They accounted for 174 incidents, compared with 149 affecting Enterprise IT. 
• Ransomware continues to affect organizations across the automotive value chain. VicOne observed 97 incidents, led by dealers and retailers (24) and suppliers (23). 
• Command injection led the quarter’s software weaknesses. CWE-78 accounted for 19 findings, followed by stack-based buffer overflow and missing authentication with 13 each. 
• AI-related risks appeared across three automotive layers. Q3 findings involved vehicle perception, manufacturing systems, and enterprise workflows. 

Automotive cyber risk in Q3 2026 remained distributed across the broader mobility ecosystem, affecting organizations, technologies, and connected systems beyond the vehicle itself. The Q3 2026 VicOne Situational Awareness Report examines this activity from July 1 through September 30, 2026, highlighting the threat patterns and security issues shaping the automotive cybersecurity landscape. 

About the report

The Q3 2026 VicOne Situational Awareness Report brings together observed threat activity, vulnerability data, and security research relevant to the automotive, transportation, and logistics sectors. VicOne publishes this report to help security teams identify recurring areas of exposure, understand where activity is concentrated, and place individual findings in a broader quarterly context.

The analysis covers:

• Reported cybersecurity incidents by region
• Affected automotive, transportation, and logistics domains
• Ransomware activity and victim sectors across the mobility ecosystem, including named group attribution
• Common Weakness Enumeration (CWE) findings and vulnerability types
• Relevant security research and vulnerability disclosures

• AI-related threats affecting automotive systems and development workflows

The findings reflect activity observed within VicOne's monitoring scope and do not represent every automotive cybersecurity incident worldwide. Changes between reporting periods may reflect both shifts in threat activity and differences in publicly available reporting.

Where was automotive cyber risk concentrated in Q3 2026?

While the overall incident count declined from Q2, the Q3 data points to meaningful shifts in regional activity and the automotive systems most affected. 

Regional activity redistributed, with Asia closing the gap on Europe

Figure 1. Regional distribution of observed automotive cybersecurity incidents in Q2 and Q3 2026

The Americas accounted for the largest share of observed automotive cybersecurity incidents at 184 cases, down from 245 in Q2. The most notable shift was the narrowing gap between Europe and Asia: Asia rose 36.8% to 93 incidents, nearly matching Europe at 95. Globally attributed incidents also fell from 39 to 16, indicating that more cases were tied to specific regions during the quarter. 

In-vehicle systems became the most affected domain

Figure 2. Distribution of observed automotive cybersecurity incidents by affected domain, Q2-Q3 2026

In-vehicle systems rose slightly from 168 incidents in Q2 2026 to 174 in Q3, while Enterprise IT declined from 230 to 149. Connected backend incidents also increased from 18 to 24, while charging-related incidents fell from 28 to 23. This placed greater emphasis on technologies tied directly to vehicle operation and connectivity.  

Notable Q3 2026 findings affecting vehicle operations and connectivity

Several Q3 2026 findings illustrate how weaknesses in access control, trusted communications, and software delivery can extend into vehicle functions, connected services, and supporting infrastructure. 

• My Eicher fleet platform exposed vehicle and customer accounts. A security researcher disclosed unauthenticated API weaknesses that could enable account takeover and access to commercial vehicle fleets, including location and telemetry data. The reported issues were remediated by July 28. 

• Trailer communications provided a path to a tractor’s brake controller. NMFTA research found that vulnerabilities in Bendix EC80 brake controllers could be reached through J2497/PLC4TRUCKS signal injection or trailer-connected telematics systems.  

• ISO 15118 Plug & Charge was shown to be vulnerable to relay attacks. Researchers demonstrated that an attacker could relay a victim EV’s authentication to another charging station, allowing the attacker’s vehicle to charge while billing the victim’s contract. 

• Malware was distributed through an automotive head unit’s update chain. Security analysts identified Android malware delivered through the legitimate update software used by DoFun head units, turning affected systems into endpoints for advertising fraud and proxy-botnet activity. 

• BYD Shark 6 assessment demonstrated abuse of connected vehicle access. Researchers used access to an Android-based head unit to remotely monitor and manipulate vehicle functions. The setup initially required physical access and used independent connectivity rather than BYD’s backend. 

What did automotive ransomware activity look like in Q3 2026?

VicOne observed 97 incidents during the quarter, with monthly activity declining from 39 incidents in July to 35 in August and 23 in September. 

Figure 3. Observed automotive-sector ransomware incidents by month in Q3 2026

Attribution was fragmented, with no group exceeding 12% of incidents

Figure 4. Distribution of observed automotive-sector ransomware incidents by attributed group in Q3 2026

Qilin was the most frequently identified group in Q3 2026, with 11 incidents, followed by The Gentlemen with seven and Settra with four. Groups outside those leading entries collectively accounted for 54 incidents, representing 56% of the quarterly total. 

Ransomware exposure extended across the automotive value chain

Figure 5. Distribution of observed automotive-sector ransomware incidents by industry segment in Q3 2026

Dealers and retailers recorded the most incidents, with 24, followed closely by suppliers at 23. Logistics and Transportation and OEMs each recorded 13 incidents. The distribution confirms that ransomware risk in the automotive sector is not limited to vehicle manufacturers - it runs through the full supply chain, including technology partners and service providers that support automotive operations. 

Named victim claims in Q3 2026 

Several ransomware groups publicly named automotive organizations and technology partners as alleged victims, although not all claims could be independently verified: 

• CRPx0 claimed an attack on the regional operations of a global automaker. The group alleged that it had exfiltrated 1.5 GB of personnel and recruitment data. 
• D1R alleged access to data associated with an automotive supplier through a technology provider. However, the provider said its investigation found no evidence of unauthorized access, weakening the allegation. 

Although ransomware often targets enterprise IT, its impact can extend across manufacturing and supplier operations. In September 2025, the JLR cyber incident halted production for weeks and was estimated to have caused £1.9 billion in economic impact. In a subsequent development, authorities reportedly detained a suspected ShinyHunters member linked to the incident in October 2026. 

Which CWEs were most common in Q3 2026? 

Common Weakness Enumeration (CWE) data helps identify the recurring software and design weaknesses behind disclosed automotive vulnerabilities. In Q3 2026, the leading findings involved command injection, memory safety, and authentication and authorization, showing that exposure remained distributed across both implementation-level flaws and weaknesses in security controls. 

Table 1. Most frequently identified CWEs in Q3 2026 compared with Q2 2026. Thirteen Q3 records without an identified CWE were excluded. 

Compared with Q2, the leading Q3 weaknesses shifted away from web-facing issues such as SQL injection and cross-site scripting toward command injection, memory safety, authentication and authorization. 

Which CWEs affected charging infrastructure? 

OS command injection became particularly prominent in Q3, increasing from one finding in Q2 to nine. However, the relatively small number of findings in this domain means quarter-over-quarter changes should be interpreted cautiously. 

Table 2. Most frequently identified CWEs affecting Charging Infrastructure in Q3 2026 compared with Q2 2026 

Which CWEs affected in-vehicle technology? 

Memory-safety weaknesses were prominent in the Q3 in-vehicle findings, led by out-of-bounds write and buffer overflows. Authentication, access control, and command injection findings show that exposure was not limited to memory handling alone. 

Table 3. Most frequently identified CWEs affecting In-Vehicle Technology in Q3 2026 compared with Q2 2026, excluding 10 Q3 records for which no CWE was identified 

These CWEs are more than statistical categories — they represent weaknesses that can affect real automotive systems. Research demonstrated a 0-click stack-based buffer overflow in the Alpine iLX-F511 infotainment system, while seven patched Kenwood DNR1007XR vulnerabilities spanned memory-safety, command-injection, and permission weaknesses. Meanwhile, 20 patched Phoenix Contact CHARX vulnerabilities showed how weaknesses in authentication, input validation, and firmware verification could provide paths to deeper charging-system access. 

How did AI-related cyber risks affect automotive systems in Q3 2026? 

AI-related cyber risks in Q3 2026 appeared across various layers of the automotive ecosystem. The examples below show how AI may be manipulated as part of a vehicle attack, used to support attacks against operational technology, or exploited through the permissions granted to enterprise agents. 

• Vehicle systems. Researchers developed JackZebra, an adversarial framework that used a display mounted on a lead vehicle to influence an autonomous driving system and divert it toward an attacker-selected destination. 
• Manufacturing systems. Threat actors reportedly used AI-generated scripts to interact with exposed Siemens S7 PLCs, illustrating how generative AI could support attacks against industrial environments. 
• Enterprise workflows. Researchers showed how indirect prompt injection could manipulate browser-based AI agents into performing unauthorized actions through connected services such as Gmail and Google Drive. 

These findings indicate that AI-related risk is becoming increasingly operational. As AI capabilities advance, automotive organizations must assess exploitability, agent permissions, and AI supply chain dependencies alongside conventional vulnerability severity. 

Conclusion 

Q3 2026 showed that automotive cyber risk continues to extend across vehicle systems, enterprise environments, infrastructure, and supply chains. Five highlights stand out: 

• Exposure remained broad despite the lower incident count. VicOne observed 400 incidents in Q3, compared with 477 in Q2, but activity continued across regions and throughout enterprise, manufacturing, connected, and in-vehicle environments. 
• Risk moved closer to vehicle systems. In-vehicle systems overtook Enterprise IT, indicating greater concentration in technologies directly tied to vehicle operation, connectivity, and driver and passenger functions. 
• Recurring weaknesses created practical attack paths. Q3 research showed how memory-safety, command-injection, authentication, and authorization weaknesses could affect IVI systems, vehicle communications, and charging infrastructure. 
• Third-party connections remained consequential. Fleet platforms, software dependencies, cloud services, and supplier environments showed how exposure can enter through systems surrounding the vehicle. 
• AI-related risk became more operational. The quarter’s findings extended from attacks against vehicle perception to AI-assisted industrial activity and manipulation of enterprise agents. 

These findings reinforce the need for visibility across the connected automotive ecosystem. Security teams must understand how weaknesses and threat activity in enterprise systems, development environments, infrastructure, and third-party components could affect vehicle-related operations — and respond before isolated issues spread across those connections. 

VicOne helps automotive organizations strengthen end-to-end visibility through next-generation vehicle security operations centers (VSOCs) and AI-driven threat intelligence platforms, supporting faster detection, informed response, and stronger resilience across the automotive value chain. 

Stay ahead of emerging automotive threats. Subscribe to xAurient Threat Alerts for timely, actionable intelligence on the risks shaping the connected mobility ecosystem. 

Frequently asked questions 

What were the key automotive cybersecurity findings that emerged in Q3 2026? 

VicOne observed 400 automotive cybersecurity incidents in Q3, down 16.1% from Q2. In-vehicle systems became the most affected domain, Asia recorded a 36.8% quarterly increase, and recurring weaknesses included command injection, memory-safety flaws, and missing authentication. AI-related risks also appeared across vehicle systems, manufacturing environments, and enterprise workflows. 

What do the Q3 2026 findings mean for automotive security teams? 

The Q3 findings show that automotive cyber risk should be assessed across the wider connected ecosystem rather than within individual systems. Security teams need to understand how weaknesses in vehicles, enterprise environments, manufacturing operations, cloud services, and third-party components could connect—and prioritize risks by potential operational impact. 

How can automotive organizations monitor cyber risks across connected vehicles? 

A vehicle security operations center (VSOC) can bring together telemetry from vehicle endpoints and supporting services to detect, investigate, and respond to threats. VicOne xNexus provides contextualized attack-path intelligence and visibility across vehicles, cloud services, APIs, and connected applications.  

How can security teams identify which automotive threats require attention? 

Automotive-specific threat intelligence helps teams connect emerging threats with relevant vehicle components, vulnerabilities, suppliers, and attack paths. VicOne xAurient monitors open, deep, and dark web sources and prioritizes intelligence according to an organization’s risk profile.