The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity cybersecurity advisory warning of critical security vulnerabilities identified in Tata Motors Passenger Vehicles’ connected car applications, specifically iRA 2.0 and iRA.ev.

The national cybersecurity agency cautioned that potential exploitation of these flaws could allow malicious actors to compromise sensitive communications and target back-end digital vehicle infrastructure. In response, Tata Motors confirmed that mandatory over-the-air (OTA) patches have already been deployed and rolled out to mitigate all flagged risks. Read our coverage of national tech policy in our report on India Considers Scrapping Social Media Safe Harbour Under IT Act.

01. What Vulnerabilities Were Flagged by CERT-In?

According to cybersecurity disclosures from CERT-In, four key vulnerabilities were detected within the architecture of Tata Motors’ connected mobility software suite:

Vulnerability Type Technical Risk Description Impact Level
Hardcoded Credentials Presence of static sensitive authentication keys embedded within the client application binary. High
Token & Session Logging Insecure handling and exposure of authentication tokens in system debug and device storage logs. High
Insecure Back-End Communications Weaknesses in TLS/SSL validation protocols between the smartphone app and remote vehicle telematics servers. Medium – High
Improper Web View Handling Flaws in rendering embedded web components, opening potential vectors for cross-application script tampering. Medium

02. Tata Motors Response: Patches Deployed via iRA 2.0 and iRA.ev

Addressing the findings, an official spokesperson for Tata Motors Passenger Vehicles stated that internal engineering teams acted swiftly to neutralize the vulnerabilities in coordination with CERT-In:

  • Mandatory Version Updates: Mandatory updates were pushed to production for iRA 2.0 (version 26.8.2) and iRA.ev (version 26.9.1) across Android and iOS ecosystems.
  • No Evidence of Data Breach: Comprehensive telemetry and internal security audits confirmed zero evidence of unauthorized vehicle access, telemetry manipulation, credential exposure, or customer data compromise.
  • Automatic Prompts: Active application users are automatically prompted to update upon launch, completing installation seamlessly in a few minutes.

03. Safety Checklist for Tata EV & ICE Connected Car Owners

To ensure optimal digital and telematics security, vehicle owners should follow these immediate steps:

  1. Open the Google Play Store or Apple App Store and verify that Tata iRA is updated to v26.8.2 or higher.
  2. For electric vehicle owners, verify the Tata iRA.ev application is updated to v26.9.1 or higher.
  3. Do not run connected vehicle apps on jailbroken or rooted mobile devices.
  4. Reset app account passwords and ensure multi-factor authentication (MFA) remains active on associated email accounts.

04. Frequently Asked Questions (FAQ)

Are Tata cars vulnerable to remote hacking?

No unauthorized vehicle access has occurred. Tata Motors verified that the security flaws flagged by CERT-In in the iRA mobile apps were patched via mandatory software updates in August and September 2026.

Which versions of the Tata iRA app are safe?

Users should update immediately to iRA 2.0 version 26.8.2 (for ICE vehicles) and iRA.ev version 26.9.1 (for electric vehicles) or later releases.

What does CERT-In recommend for connected car applications?

CERT-In recommends strict API session validation, eliminating hardcoded keys, implementing end-to-end encrypted telemetry, and ensuring prompt installation of OEM security updates.

05. Related NewsY Coverage

Track regional mobility policies in the Karnataka Bus Fare Revision Analysis, explore manufacturing and commercial vehicle trends in our report on Ashok Leyland’s Share Price Surge, and check sports updates in our BCCI Shifts IND vs SL 1st ODI to Vizag.

06. Related Images

Tata Motors iRA connected car app cybersecurity alert with a security shield, smartphone update screen and vehicle illustration.

07. Sources

  • CERT-In (Indian Computer Emergency Response Team): Vulnerability Advisory on Connected Automobile Applications, November 2026.
  • Press Trust of India & Economic Times: Tata Motors PV Says CERT-In-Flagged App Vulnerabilities Addressed Through Updates, 5 November 2026.

NewsY Cyber & Automotive Desk: Security advisories and automaker responses reflect verified statements issued by CERT-In and Tata Motors Passenger Vehicles.