The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity alert for Tata Motors' connected vehicle apps, iRA 2.0 and iRA.ev. The vulnerabilities could potentially allow unauthorized access to sensitive user data and remote vehicle commands. Tata Motors has released software updates to fix these issues. For investors, this highlights the increasing operational risks associated with digital and software integration in the modern automotive sector.
The Indian Computer Emergency Response Team (CERT-In) issued a high-severity advisory on November 4, 2026, regarding critical security vulnerabilities found in Tata Motors' connected vehicle applications. The alert impacts the iRA 2.0 and iRA.ev platforms, which are used by vehicle owners for remote monitoring and connectivity features.
According to the advisory, the vulnerabilities exist in older versions of these applications, specifically iRA 2.0 versions 26.7.3 and below, and iRA.ev versions 26.7.2 and below. The security flaws stem from issues such as hardcoded service account credentials, insufficient validation of web content, and the storage of sensitive authentication tokens within application logs. Additionally, the advisory noted improper implementation of SSL certificate pinning, which can compromise the communication channel between the user's mobile device and the vehicle's backend services.
These technical weaknesses could theoretically allow unauthorized parties to intercept or modify data, impersonate users, or execute remote commands. Given that these platforms manage critical functions like vehicle health monitoring and trip logging, the ability for an attacker to manipulate these systems poses a potential risk to consumer privacy and vehicle security.
Tata Motors has provided the necessary patches to address these issues. Users are advised to update their applications to the latest versions—version 26.8.2 for iRA 2.0 and version 26.9.1 for iRA.ev—to mitigate the identified risks.
For investors, this event serves as a reminder of the growing reliance on software in the automotive industry. As car manufacturers increasingly move toward "connected" vehicles, cybersecurity becomes a central operational priority. While this specific incident involves an app update, it underscores the importance of robust digital infrastructure and data security protocols for companies moving into high-tech mobility solutions. Reputational risk remains a key factor for stakeholders, as any lapse in data safety can impact consumer trust in the company's connected ecosystem.
The company has not issued an exchange filing regarding this security advisory as of November 4, 2026. The key monitorable for investors will be the speed of user adoption for these updates and whether there are any further regulatory communications regarding the incident. Future updates on the company's cybersecurity framework and investment in digital infrastructure will remain relevant as the auto sector continues its transition toward software-heavy vehicle architectures.