Pwn2Own Automotive 2026 concluded with a landmark performance that highlighted both the expanding attack surface of modern automotive systems and the critical role of proactive security research in mitigating emerging risks. Held over three days in Tokyo, Japan, at the Automotive World conference, this year’s event set new records with 76 previously unknown zero-day vulnerabilities disclosed and more than $1,047,000 in cash prizes awarded to elite security research teams from around the globe.
What Is Pwn2Own Automotive?
Pwn2Own Automotive is a premier competitive security event organized by Trend Micro’s Zero Day Initiative (ZDI) in collaboration with industry partners such as Tesla and Alpitronic. It focuses on uncovering critical vulnerabilities in automotive technologies that power software-defined vehicles (SDVs), infotainment systems, EV charging stations, and more. Participants are tasked with finding exploitable flaws in these complex systems under highly controlled conditions.
This contest is part of a broader ecosystem of Pwn2Own competitions, which historically spotlight vulnerabilities in consumer and enterprise software, hardware, and embedded systems. The Automotive edition expands this lens to the evolving mobility landscape.
Record-Setting Discoveries
Pwn2Own Automotive 2026 shattered expectations with 73 total attempts and 76 unique zero-day vulnerabilities confirmed over the three days of competition. The payout of over one million USD reflected the technical complexity and real-world relevance of the flaws uncovered.
Highlights by the Numbers
- 76 unique zero-day vulnerabilities discovered during the event.
- $1,047,000+ awarded in total prize money.
- Fuzzware.io crowned Master of Pwn 2026, earning 28 points and $215,500 across multiple successful demonstrations.
Targets and Techniques
The competition spanned multiple categories of automotive technology, reflecting the broadening threat landscape for modern vehicles and charging infrastructure.
In-Vehicle Infotainment (IVI)
On Day One alone, researchers disclosed 37 unique flaws targeting IVI systems from major vendors such as Tesla, Sony, and Alpine. Flaws included memory corruption, logic errors, and insecure interfaces that enabled:
- Arbitrary code execution
- Privilege escalation to root
- Full system takeover via USB-based attacks
These demonstrations showed how seemingly benign services and interfaces on infotainment modules can be entry points to deeper system compromise.
EV Chargers: A New Frontline
EV charging stations — once considered peripheral to vehicle cybersecurity — were a core focus in 2026. Security researchers successfully demonstrated exploits against a broad range of Level 2 and Level 3 chargers from leading manufacturers. Highlights include:
- Out-of-bounds write exploitation on the Alpitronic HYC50, allowing full control of the device.
2-bugand3-bugchains combining code execution with signal manipulation techniques.- Proof-of-concept manipulations that could disrupt charging processes or be leveraged in larger network attacks.
These results underscored how connected EV infrastructure introduces novel risks to the broader energy-transport ecosystem.
Spotlight: Master of Pwn — Fuzzware.io
The German research team Fuzzware.io demonstrated exceptional technical depth and consistency across multiple exploit categories. Their successful campaigns included:
- Achieving remote code execution and control on commercial fast chargers.
- Chaining multiple vulnerabilities to compromise EV charging controllers.
Their performance at Pwn2Own Automotive 2026 not only secured the top podium spot but also set a new bar for collaborative vulnerability research in the automotive domain.
Why It Matters: Strategic Implications
Automotive systems are increasingly defined by complex software stacks and networked components. Connected vehicles, infotainment systems, telematics modules, and EV charging infrastructure all interact within an ecosystem rich with data flows, control commands, and safety-critical functions. The sheer volume and severity of exploitable flaws demonstrated at Pwn2Own Automotive 2026 emphasize three key points:
- Automotive cybersecurity is no longer theoretical: The vulnerabilities exposed are real, demonstrable, and potentially exploitable if left unpatched.
- Attack surfaces extend beyond vehicles: EV charging infrastructure — once considered a separate domain — now shares many of the same risk vectors as in-vehicle systems.
- Responsible disclosure accelerates hardening: Through coordinated reporting and vendor engagement, these discoveries will lead to patches, advisories, and stronger defensive baselines across the industry.
What Happens Next
Under responsible disclosure practices, vendors now have a set period (often around 90 days) to analyze reported vulnerabilities and issue patches before full public disclosure of technical details and associated CVE identifiers. This means the next several months will be critical for:
- Patch development and deployment by affected vendors.
- Publication of CVE records and advisories for the 76 discovered flaws.
- Security community analysis to understand broader implications for vehicle and infrastructure safety.
Conclusion
Pwn2Own Automotive 2026 demonstrated that automotive and EV ecosystems are rich with exploitable attack surfaces — but also that coordinated, expert research can uncover and mitigate these risks before they become chaos on the road. As vehicles evolve into software-defined platforms and charging networks become integral to transportation infrastructure, contests like Pwn2Own play a crucial role in bridging the gap between vulnerability discovery and real-world security improvement.
