# Researchers Identify 413 Automotive Software Vulnerabilities, Showing a Shift to Cloud Vectors

- Published: 2026-11-08 10:00 UTC
- Section: Digital & Computing › Data security
- Tags: connected vehicle security, automotive software vulnerabilities, Software Quality Journal, automotive cloud security, telematics flaws
- URL: https://realtech.media/news/rt-1286f3089c646f40626a1591_researchers_identify_413/

**An analysis of 413 automotive flaws reveals external cloud services and mobile apps now form the leading attack surface.**

![Researchers Identify 413 Automotive Software Vulnerabilities, Showing a Shift to Cloud Vectors](https://realtech.media/media/2026/11/1def6d5c00da9ea0.webp)
*science-et-vie.com*

Researchers from the University of Gothenburg and Chalmers University of Technology analyzed 413 automotive software vulnerabilities identified between January 2022 and September 2024, according to a study published in the Software Quality Journal [1]. By scanning databases and software repositories, the team tracked modern attack vectors across the entire Software Development Life Cycle (SDLC) to determine how digital threats to connected vehicles have evolved [1].

## Shift to Web and Cloud Vectors

The data shows that mobile applications, websites, and cloud services linked to connected vehicles now represent 36.2% of identified vulnerabilities, becoming the most exposed category [1]. When comparing current records to the 2010–2019 period, the share of external software weaknesses climbed from 14.5% to 41.3%, while the proportion affecting embedded onboard systems dropped from 69.1% to 44.3% [1]. Furthermore, high-severity flaws accounted for 44.8% of the total, and critical vulnerabilities rose from 5.1% to 16.3% [1]. Traditional web security issues dominate this segment: SQL injection emerged as the most frequent technique, followed by cross-site scripting [1].

## Supply Chain and Embedded Risks

The authors also audited 20 automotive software repositories, scanning source trees, Software Bills of Materials (SBOMs), images, and manifest files [1]. This automated inspection uncovered 827 vulnerable reusable software libraries, including shared cryptographic modules used across multiple implementations [1]. Among hardware and chip providers, Qualcomm accounted for 58 reported vulnerabilities, reflecting market penetration and vendor reporting habits [1].

While remote access through web endpoints presents an immediate data risk, vehicle interiors remain exposed if infotainment and telematics units lack isolation from internal communication buses [1]. In 2023, ethical hackers bypassed vehicle boundaries to access steering and braking controls through multimedia systems [1]. The researchers emphasize that engineering teams must enforce architectural separation between remote-facing endpoints and core automotive actuators [1].

## Sources

1. [Software Quality Journal](https://doi.org/10.1007/s11219-026-09787-y)
2. [science-et-vie.com](https://www.science-et-vie.com/technos-et-futur/le-point-faible-de-votre-voiture-ne-se-trouve-peut-etre-pas-dans-votre-voiture-mais-dans-des-serveurs-a-lautre-bout-du-monde-265481.html)

---

Source: RealTech, realtech.media — https://realtech.media/news/rt-1286f3089c646f40626a1591_researchers_identify_413/