CVE-2026-27772 EV Energy CVE debrief

Who should care

EV charging operators, fleet charging program owners, backend platform administrators, OT/ICS defenders, and teams that manage OCPP WebSocket infrastructure should treat this as urgent. It is especially relevant anywhere charger identity is trusted based only on a station identifier rather than strong authentication.

Technical summary

The CISA source describes a lack of authentication on OCPP WebSocket endpoints. An attacker does not need credentials to establish a connection if they know or can discover a station identifier. Once connected, the attacker may impersonate a charger and interact with backend OCPP workflows, which can undermine integrity of telemetry and control messages. The advisory assigns CVSS 3.1 9.4 Critical with network attack vector, no privileges required, no user interaction, and high confidentiality and integrity impact with low availability impact.

Defensive priority

Critical priority. This is a network-reachable authentication failure on a control path that directly affects EV charging operations and backend trust. Because the issue enables unauthorized impersonation and data manipulation without credentials, exposure should be reduced immediately and compensating controls should be checked at once.

Recommended defensive actions

• Restrict access to OCPP WebSocket endpoints to trusted networks and management paths only.
• Require strong authentication for every charger connection and session, not just a station identifier.
• Validate station identity and authorize each connection and command exchange on the backend.
• Review logs for unexpected charger connections, reused identifiers, or anomalous OCPP activity.
• Revoke or rotate any credentials, identifiers, or secrets that may have been exposed or guessed.
• Verify that backend records and charger state data have not been altered or corrupted.
• Apply CISA-recommended ICS defensive practices for segmentation, monitoring, and defense in depth.
• Contact EV Energy through the vendor contact page referenced by CISA for remediation guidance.

Evidence notes

All substantive claims in this debrief are drawn from the supplied CISA CSAF source item for ICSA-26-057-07 and its metadata. The source states that EV Energy did not respond to CISA's coordination request, and no vendor fix details are provided in the corpus. Timing is based on the CVE publishedAt/modifiedAt and source publishedAt/modifiedAt values of 2026-02-26T07:00:00.000Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.