Mercedes CeBAS Secure Access in Bosch ADS 7.3: A Workshop Readiness Guide
A scan tool can identify a late-model Mercedes-Benz and still stop at the functions the customer actually needs. The vehicle is not necessarily faulty and the tool is not necessarily unsupported; the diagnostic session may be waiting for online identity and gateway authorization.
What changed: Bosch ADS software version 7.3, released in April 2026, adds secure diagnostic coverage for listed 2020–2026 Mercedes-Benz vehicles protected by CeBAS. Bosch describes the route as CeBAS certificate-based security using Seed & Key authentication through MBA unlock. The documented process requires internet access and a SingleKey ID account, but Bosch says an AutoAuth subscription is not required for this Mercedes flow. This is an expansion of authorized diagnostic access on specified ADS tools and listed vehicles—not blanket coverage for every Mercedes, an ECU flashing license, or a method to bypass security.
What Bosch officially announced
The Bosch ADS X 7.3 release page, dated April 8, 2026, highlights a large Mercedes-Benz Secure Access update for various 2020–2026 models. Bosch says the release supports vehicles protected by CeBAS, short for Certificate Based Automotive Security, and uses Seed & Key authentication via MBA unlock.
The accompanying official version 7.3 release notes show an online unlock process. The tool identifies the vehicle by VIN, connects to a gateway service, authenticates controllers and requests a SingleKey ID sign-in. Bosch instructs users not to disconnect or power off the vehicle while communication is being initialized.
| Item | Bosch version 7.3 statement | Workshop interpretation |
|---|---|---|
| Vehicle scope | Various listed Mercedes-Benz models from 2020–2026. | Check the exact model and year in the current coverage notes. |
| Security context | CeBAS with Seed & Key authentication via MBA unlock. | The tool follows an authorized online route; it is not a security bypass. |
| User identity | SingleKey ID sign-in and Secure Diagnostic Access terms. | Create and verify the account before the vehicle occupies the bay. |
| Network | Wi-Fi internet is required for gateway unlock. | Test workshop connectivity and avoid roaming or unstable hotspots. |
| AutoAuth | No AutoAuth subscription required for this Mercedes feature. | Do not generalize this to other OEM secure-gateway systems. |
| Result | Diagnostic menu becomes available after successful unlock. | Available functions still depend on ADS coverage and vehicle configuration. |
This is a concrete example of the broader trend described in our authorized secure-gateway checklist: modern diagnostic capability depends on tool, vehicle, account and network being accepted in the same session.
CeBAS, Seed & Key and MBA unlock are not interchangeable labels
Bosch uses all three terms in the release description, which can confuse buyers. CeBAS names the Mercedes certificate-based security environment. Seed & Key describes an authentication mechanism referenced by Bosch. MBA unlock is the access route named in the Bosch ADS implementation. The release note does not say that any generic seed-key calculator or unrelated pass-thru device can reproduce this workflow.
AutoAuth is a separate service commonly associated with other secure gateway programs. Bosch explicitly says its version 7.3 Mercedes CeBAS route does not require an AutoAuth subscription. That does not mean secure access is anonymous or offline: Bosch still documents SingleKey ID, acceptance of Secure Diagnostic Access conditions and an internet connection.
SingleKey ID is provided by Robert Bosch GmbH for access to Bosch and partner services. Its current terms page shows that the account is a separate digital service with jurisdiction-specific terms. A workshop should assign real accounts to authorized staff rather than share one generic login.
What should be ready before the vehicle enters the bay?
- Confirm the exact ADS platform and software. Verify that the tool is on version 7.3 or a later supported release and that its subscription or entitlement is active for the required functions.
- Check the coverage list. Match model year, model and system against the current Bosch notes. “Mercedes 2020–2026” is a summary range, not a universal support statement.
- Prepare SingleKey ID. Create the account, verify the email and retain access to the registered mailbox. Accept applicable terms only after the business has reviewed them.
- Test workshop internet. Use a stable connection in the actual bay. The Bosch process communicates with the gateway service and must not be interrupted.
- Prepare vehicle power support. Follow the vehicle and tool procedure for battery support. Do not begin an online security session with a weak vehicle battery.
- Obtain customer authorization. Record the VIN, requested diagnostic function, technician and purpose before secure access is attempted.
The workflow can identify the vehicle from its VIN, so an incorrect vehicle selection should be corrected before unlock. Save screenshots or records permitted by the tool and your privacy process; never publish customer VINs or account details.
What happens during the documented unlock?
At a high level, the ADS tool identifies the vehicle, displays a secure-access notice and connects to the gateway service. The user signs in through the Bosch flow and accepts the relevant Secure Diagnostic Access condition when prompted. The application then authenticates the controllers and reports whether vehicle unlock succeeds.
Technicians should follow the current on-tool prompts rather than this summary. Bosch's illustrated steps and interface can change after version 7.3. Do not leave the vehicle, switch networks, close the application or power down during initialization. If the session fails, record the stage and message before restarting anything.
Evidence worth keeping
- ADS hardware identity and software version.
- Vehicle VIN and verified model selection in the protected job record.
- Authorized technician and account used.
- Start time, unlock result and any error code.
- Pre-scan and post-operation scan where applicable.
- Customer authorization and the diagnostic function requested.
A successful gateway unlock is not ECU programming permission
The Bosch release concerns diagnostic access and lists DTC, data and bi-directional coverage among its wider updates. A gateway unlock may expose functions that were previously blocked, but it does not automatically provide OEM module software, calibration files, coding rights or programming procedures.
Our J2534, DoIP and CAN FD guide explains why access, interface and network transport are separate layers. Likewise, a bench ECU programmer works outside the vehicle on supported control units and memory operations. It cannot be assumed to replace a CeBAS diagnostic route.
The ECU programmer fundamentals guide separates ECU read/write work from ordinary diagnostics. Decide which job the customer needs before choosing the tool: fault diagnosis, bidirectional test, adaptation, OEM programming, module replacement, file backup or authorized calibration work.
How to troubleshoot a failed secure-access session
| Failure stage | First evidence to check | Do not assume |
|---|---|---|
| Vehicle not identified | VIN, model selection, base communication and ADS coverage. | CeBAS rejected the account. |
| Unlock notice never appears | Software version, protected model status and selected system. | Every function is already unlocked. |
| Sign-in fails | SingleKey ID, verified email, password and current terms. | The vehicle gateway is defective. |
| Gateway service connection fails | Internet stability, firewall, time settings and Bosch service status. | A different cable will bypass online authentication. |
| Unlock succeeds but function is absent | Exact ADS function coverage, vehicle equipment and entitlement. | Unlock creates unsupported functions. |
Retry only after identifying a plausible cause. Repeated online login attempts can complicate account troubleshooting, while repeated vehicle communication cycles can drain a weak battery. Preserve the exact message and contact the tool provider with version, model and stage information.
Frequently asked questions
What is Mercedes-Benz CeBAS?
Bosch expands the acronym as Certificate Based Automotive Security. In ADS 7.3 it is the protected environment addressed by the documented Mercedes secure diagnostic access flow.
Does Bosch ADS 7.3 support every 2020–2026 Mercedes?
No. Bosch says various models and provides a detailed list in the release notes. Confirm the exact model year and model in the latest coverage information.
Is an AutoAuth subscription required?
Bosch says no AutoAuth subscription is required for this Mercedes CeBAS feature. Other manufacturers and secure-gateway routes can have different account requirements.
Is internet access required?
Yes. Bosch states that Wi-Fi internet is required to unlock the gateway module. Use a stable workshop connection and do not interrupt the vehicle during initialization.
Does a SingleKey ID guarantee gateway access?
No. The account is one prerequisite. Tool version, vehicle coverage, terms, network, vehicle state and Bosch service response still affect the session.
Can KT200II perform the same CeBAS unlock?
Do not assume so. KT200II ECU memory operations and Bosch ADS secure vehicle diagnostics are different workflows. Use the tool and authorized access path documented for the requested operation.
Secure access begins before the scan tool is connected
Bosch ADS 7.3 shows where professional diagnostics is heading: vehicle coverage alone is no longer enough. The verified user, current software, online service, stable vehicle and supported function must align.
Before accepting a Mercedes secure-access job, check the current Bosch coverage and prepare the account away from the bay. For ECU memory work, send ECUToolStore the ECU label and requested mode so compatibility can be reviewed separately from vehicle gateway access.