The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Automotive
Breach intelligence, attack campaigns, and threat reports targeting the Automotive sector.
Explore Other Sectors
Automotive Threat Reports
Siemens TPM 2.0 Vulnerability (CVE-2025-2884) Disclosure
In April 2026, Siemens disclosed a vulnerability (CVE-2025-2884) in its TPM 2.0 implementation, affecting multiple products including SIMATIC and SIPLUS IPC series. The flaw, an out-of-bounds read in the CryptHmacSign function, could allow local attackers to access sensitive information or cause a denial of service. Siemens has released updates for several affected products and is preparing further fixes, recommending users to update to the latest versions. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-628843.html?utm_source=openai)) This incident underscores the critical importance of timely firmware updates and robust access controls, especially as TPM vulnerabilities can compromise foundational security features like encryption and secure boot processes.
5 months ago
Kill Chain
Jaguar Land Rover Cyberattack August 2025: A Comprehensive Analysis
In late August 2025, Jaguar Land Rover (JLR), the UK's largest automotive manufacturer, experienced a significant cyberattack that severely disrupted its operations. The attack, attributed to the cybercriminal group 'Scattered Lapsus$ Hunters,' led to a complete shutdown of JLR's production facilities across the UK, Slovakia, China, India, and Brazil. The company halted production on September 1, 2025, and the disruption extended for over five weeks, with operations resuming in mid-October. This incident resulted in substantial financial losses, with JLR reporting nearly £200 million in direct costs and a 43% decline in vehicle output during the affected period. The attack also had a cascading effect on the broader automotive supply chain, leading to layoffs and economic repercussions across the sector. ([computerweekly.com](https://www.computerweekly.com/news/366630592/Jaguar-Land-Rover-admits-data-has-been-compromised-in-cyber-attack?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure and large-scale manufacturing operations. The JLR cyberattack highlights the vulnerabilities within interconnected supply chains and the potential for significant economic impact resulting from such breaches. It serves as a stark reminder for organizations to bolster their cybersecurity measures, particularly in the face of increasingly sophisticated cyber threats.
5 months ago
Kill Chain
Critical Vulnerability in wolfSSL: CVE-2026-5194 Allows ECDSA Certificate Authentication Bypass
In April 2026, a critical vulnerability identified as CVE-2026-5194 was discovered in the wolfSSL library, a widely used SSL/TLS implementation designed for embedded systems and IoT devices. This flaw arises from missing hash/digest size and Object Identifier (OID) checks during the verification of ECDSA certificates, allowing the acceptance of improperly small digests. Consequently, attackers could exploit this weakness to bypass ECDSA certificate-based authentication, potentially leading to unauthorized access and man-in-the-middle attacks. The issue affects configurations where both ECC and EdDSA or ML-DSA are enabled. wolfSSL addressed this vulnerability in version 5.9.1, released on April 8, 2026. The discovery of CVE-2026-5194 underscores the critical importance of rigorous certificate validation processes in cryptographic libraries. As wolfSSL is utilized in over 5 billion devices across various sectors, including industrial control systems, automotive, and aerospace, the potential impact of this vulnerability is extensive. Organizations relying on wolfSSL are urged to promptly update to the patched version to mitigate security risks.
5 months ago
Kill Chain
Mitsubishi Electric's 2025 Vulnerability: A Wake-Up Call for Industrial Security
In May 2025, Mitsubishi Electric disclosed a vulnerability (CVE-2025-0921) in their GENESIS64, MC Works64, and GENESIS products. This flaw allows local attackers to perform unauthorized writes to arbitrary files by exploiting symbolic links, potentially leading to denial-of-service conditions. The vulnerability affects all versions of GENESIS64 and MC Works64, as well as GENESIS version 11.00. Mitsubishi Electric has released patches and mitigation strategies to address this issue. ([mitsubishielectric.com](https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2025-002_en.pdf?utm_source=openai)) This incident underscores the critical importance of securing industrial control systems against local privilege escalation attacks, which can disrupt essential operations. Organizations are urged to apply the provided patches promptly and review their security protocols to prevent similar vulnerabilities.
5 months ago
Kill Chain
Critical RCE Vulnerability Discovered in PTC Windchill PLM Software
In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-4681, was discovered in PTC's Windchill Product Lifecycle Management (PLM) software. This flaw, stemming from improper deserialization of untrusted data, affects multiple versions of Windchill PDMLink and FlexPLM. Exploitation of this vulnerability could allow attackers to execute arbitrary code remotely, potentially compromising sensitive product data and disrupting manufacturing processes. PTC has acknowledged the issue and is actively developing a fix. In the interim, they have provided specific mitigation steps, including updates to Apache and IIS server configurations, to protect affected systems. Organizations utilizing Windchill are urged to implement these workarounds immediately to safeguard their environments. This incident underscores the persistent threat posed by software vulnerabilities in critical infrastructure sectors. The exploitation of deserialization flaws remains a favored technique among cyber adversaries, highlighting the necessity for continuous vigilance, timely patching, and adherence to secure coding practices to mitigate such risks.
6 months ago
Kill Chain
PolyShell Attacks Compromise Over Half of Vulnerable Magento Stores
In March 2026, attackers began exploiting the 'PolyShell' vulnerability in Magento Open Source and Adobe Commerce installations, affecting over half of all vulnerable stores. The flaw resides in Magento's REST API, which improperly handles file uploads, allowing attackers to execute remote code or perform account takeovers via stored cross-site scripting (XSS). Adobe released a fix in version 2.4.9-beta1 on March 10, 2026, but it has not yet reached the stable branch. This incident underscores the critical importance of timely patch management and the need for robust security configurations to prevent exploitation of known vulnerabilities. The rapid exploitation following public disclosure highlights the urgency for organizations to stay vigilant and proactive in their cybersecurity practices.
6 months ago
Kill Chain
Mazda's 2025 Data Breach: A Wake-Up Call for Supply Chain Security
In December 2025, Mazda Motor Corporation identified unauthorized access to a warehouse management system associated with parts procured from Thailand. The breach exposed 692 records containing user IDs, full names, email addresses, company names, and business partner IDs. No customer data was involved. Mazda promptly reported the incident to Japan's Personal Information Protection Commission and implemented enhanced security measures, including reducing internet exposure, applying security patches, increasing monitoring for suspicious activity, and introducing stricter access policies. This incident underscores the persistent threat of cyberattacks targeting supply chain systems. Organizations must remain vigilant, as such breaches can lead to phishing attacks and scams targeting exposed individuals. Implementing robust security protocols and continuous monitoring is essential to mitigate these risks.
6 months ago
Kill Chain
Delta Electronics CNCSoft-G2 2026 Out-of-Bounds Write Vulnerability
In March 2026, Delta Electronics identified a critical vulnerability (CVE-2026-3094) in its CNCSoft-G2 software, specifically an out-of-bounds write issue in the DOPSoft component's DPAX file parsing. This flaw allows attackers to execute arbitrary code if a user opens a maliciously crafted file, potentially compromising system integrity. The vulnerability affects CNCSoft-G2 versions prior to V2.1.0.39. Delta Electronics has released version 2.1.0.39 to address this issue and recommends users update promptly. This incident underscores the persistent risks associated with file parsing vulnerabilities in industrial control systems, emphasizing the need for regular software updates and vigilant cybersecurity practices to protect critical infrastructure.
6 months ago
Kill Chain
Critical Vulnerabilities in Everon's OCPP Backends Threaten EV Charging Security
In March 2026, multiple critical vulnerabilities were identified in Everon's OCPP Backends, affecting all versions of the platform. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([incibe.es](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-ocpp-backends-de-everon?utm_source=openai)) The discovery of these vulnerabilities underscores the growing cybersecurity risks within the electric vehicle (EV) charging infrastructure. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential operational disruptions and safeguard user data.
6 months ago
Kill Chain
Critical Vulnerabilities in Mitsubishi Electric's MELSEC iQ-F Series Expose Industrial Systems to Denial-of-Service Attacks
In March 2026, Mitsubishi Electric disclosed multiple vulnerabilities in their MELSEC iQ-F Series EtherNet/IP and Ethernet modules, specifically FX5-ENET/IP and FX5-EIP models. These flaws, identified as CVE-2026-1874, CVE-2026-1875, and CVE-2026-1876, allow remote attackers to induce denial-of-service conditions by continuously sending UDP packets, rendering the devices unresponsive until a system reset is performed. The vulnerabilities affect FX5-ENET/IP versions up to 1.106 and all versions of FX5-EIP. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1874?utm_source=openai)) This incident underscores the critical need for robust network security measures in industrial control systems, as such vulnerabilities can disrupt essential operations in critical manufacturing sectors worldwide. Organizations are advised to implement recommended mitigations, including updating firmware where available and employing network defenses to prevent unauthorized access. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-mitsubishi-electric-security-advisory-av26-191?utm_source=openai))
6 months ago
Kill Chain
Critical Vulnerabilities Uncovered in ePower's Charging Platform
In March 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory highlighting multiple critical vulnerabilities in ePower's charging platform, epower.ie. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-of-epower-charging-platform-vulnerabilities-and-mitigations.403849/?utm_source=openai)) The disclosure underscores the growing cybersecurity risks in the energy and transportation sectors, particularly concerning electric vehicle (EV) infrastructure. As EV adoption accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and maintain public trust in these emerging technologies.
6 months ago
Kill Chain
Mobiliti e-mobi.hu 2026 Authentication Vulnerabilities Expose Critical Infrastructure Risks
In March 2026, multiple critical vulnerabilities were identified in Mobiliti's e-mobi.hu platform, a key player in Hungary's electric vehicle charging infrastructure. These flaws, including missing authentication for critical functions and insufficient session expiration, could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. The vulnerabilities affect all versions of the e-mobi.hu platform, posing significant risks to the energy and transportation sectors. ([windowsforum.com](https://windowsforum.com/threads/cisa-advisories-warn-of-critical-authentication-and-session-flaws-in-mobiliti-e-mobi-platform.403855/?utm_source=openai)) This incident underscores the growing cybersecurity challenges in critical infrastructure, particularly within the rapidly expanding electric vehicle sector. As the adoption of EVs increases, ensuring the security of associated charging networks becomes paramount to prevent potential disruptions and maintain public trust.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports