In a vehicle abnormality detection device, when a transmission and reception unit receives abnormality information of a first control device on an in-vehicle network configured by a plurality of layers via a firewall, an abnormality cause candidate acquisition unit acquires a candidate for a second control device that may cause the abnormality of the first control device. An abnormality information management unit manages the first control device and the second control device as abnormality cause control devices when the second control device in which an abnormality occurs before a time when the abnormality of the first control device is detected is detected from the candidate acquired by the abnormality cause candidate acquisition unit.