Vulnerability · critical
Net-connected vehicles from two automakers allow remote unlock and engine start
Tier D · Background noise – Good to know
Who’s exposed: All net-connected vehicles from two major automakers
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Full takeover
The Brief
- Two security researchers reportedly hacked vehicle connectivity systems of two major automakers during early 2026
- Reported flaws allowed remote unlocking of doors and engine start on all net-connected vehicles from both automakers
- Source states the issues have now been patched
Why it matters
The report describes hard-coded credentials and bypassed MFA in connected-vehicle back ends, showing how basic authentication failures can expose entire vehicle fleets to remote control.
The checklist behind the tier
Checklist · 1 of 10 yes
| No | Hits tech teams | Judgment: consumer vehicle connectivity systems, not software or services developers, ops or IT teams build or run. |
| No | Core infrastructure | Judgment: automaker vehicle connectivity platforms are not core infrastructure nearly every team runs. |
| No | Popular tool | Judgment: automaker telematics backends are not a widely used framework, tool, platform, OS or package. |
| No | Exploited in the wild | Tom's Hardware: two researchers hacked the systems in early 2026; no observed attacks by criminals reported. |
| No | Public exploit | Tom's Hardware: no source says exploit code or a step-by-step proof-of-concept was published. |
| No | Remote, no login | Tom's Hardware: the attack bypassed MFA and used hard-coded credentials, so authentication was not shown to be unnecessary. |
| Yes | Full takeover | Tom's Hardware: bypassed MFA let hackers remotely unlock doors and start the engine of all net-connected vehicles. |
| No | Secrets exposed | Tom's Hardware: hard-coded credentials were the flaw, but no source says they were stolen or exposed in a breach. |
| No | Supply chain | Tom's Hardware: flaws were in vehicle connectivity access; no compromised package, update or build pipeline reported. |
| No | No fix yet | Tom's Hardware headline: the issues are now patched. |
Timeline
Tom's Hardware publishes report on the vehicle hacks
Latest from Tom's Hardware
All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine
Source
All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine ↗ Latest from Tom's Hardware · 1h ago
First seen · 1 source · Full story page · How tiers are decided