Tata Motors says security vulnerabilities in its iRA 2.0 and iRA.ev apps have been addressed, with mandatory updates rolled out in August and September 2026.
Tata Motors has issued a clarification following reports about cybersecurity vulnerabilities flagged by the Indian Computer Emergency Response Team (CERT-In) in its connected-car applications. The company says the identified issues have been addressed through software updates and enhanced security measures.
In a statement shared through its official social media accounts, Tata said its assessment found no evidence of unauthorised access to or compromise of customer credentials, personal information or vehicle-related data.
What CERT-In Flagged
CERT-In’s advisory, dated November 4, 2026, classified the vulnerabilities as High severity. It identified affected versions as iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier.
The advisory described weaknesses involving credentials embedded within the applications, insufficient validation of web content, authentication tokens appearing in debug logs and shortcomings in secure communication checks. Depending on the vulnerability and conditions, these could potentially expose sensitive information or allow unauthorised access to application services. CERT-In recommended updating to the corrected versions. CERT-In advisory.
A vulnerability warning identifies a potential security weakness. It does not, by itself, establish that attackers have exploited it or accessed customer information.
Tata Says Updates Were Already Rolled Out
According to Tata Motors, mandatory updates to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 were rolled out in August and September 2026, respectively. This places the company’s stated update rollout ahead of the public advisory issued in November.
Tata says users are automatically prompted to update when they open the respective applications, and the process can be completed over the air within a few minutes.
The company added that the update rollout has been completed for all active users. It is also proactively contacting remaining customers who have yet to complete the updates to help them move to the latest versions. This distinction matters: making an update available and having every customer install it are separate steps.
No Evidence Of Customer Data Compromise, Says Tata
Addressing concerns over customer information, Tata said its assessment indicates that customer data and vehicle-related information remain secure. The company reported no evidence of unauthorised access to customer credentials, personal information or vehicle-related data.
Tata also said it continuously monitors its systems for potential vulnerabilities and works closely with CERT-In, sharing relevant findings. Monitoring will continue following the security updates. For owners using either application, the immediate step is to check the installed version and complete any pending update through the official application channel.
The development comes against the backdrop of growing cybersecurity challenges across the automotive industry. In September 2025, JLR suffered a separate cyber incident that severely disrupted its retail and manufacturing operations, also affecting the wider supply chain.
