PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22890 Unknown Vendor CVE debrief

CVE-2026-22890 is a public information exposure issue affecting EV2GO ev2go.io. According to CISA’s advisory, charging station authentication identifiers were publicly accessible through web-based mapping platforms. The advisory was first published on 2026-02-26, and the vendor was not responsive to CISA’s coordination request.

Vendor
Unknown Vendor
Product
EV2GO ev2go.io vers:all/*
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-26
Original CVE updated
2026-02-26
Advisory published
2026-02-26
Advisory updated
2026-02-26

Who should care

Operators and maintainers of EV charging infrastructure, OT/ICS teams, and security staff responsible for public mapping integrations or externally reachable asset data should review this advisory. Organizations using EV2GO-related services or relying on exposed station metadata should assess whether authentication identifiers are visible to untrusted parties.

Technical summary

The advisory states that charging station authentication identifiers are publicly accessible via web-based mapping platforms. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating a network-reachable issue with low confidentiality and integrity impact and no availability impact. The source corpus does not provide exploit details, affected deployment specifics beyond EV2GO ev2go.io vers:all/*, or evidence of active exploitation.

Defensive priority

Medium. This is not a KEV-listed issue in the supplied corpus, but it involves exposure of authentication identifiers and merits timely review, especially for environments that publish or aggregate EV charging station data.

Recommended defensive actions

  • Review any EV2GO or EV charging station data published to mapping platforms and remove authentication identifiers from public views.
  • Restrict exposure of station identifiers to the minimum necessary audience and validate that public endpoints do not reveal sensitive authentication-related fields.
  • Audit integrations, APIs, and data feeds that populate mapping platforms for unintended data leakage.
  • Coordinate with EV2GO through the vendor contact page referenced in the advisory and track remediation status.
  • Apply general ICS defensive practices from the CISA references, including defense-in-depth and access control review for externally exposed services.

Evidence notes

All factual claims in this debrief are taken from the supplied CISA CSAF source item and its metadata. The source describes the issue as publicly accessible charging station authentication identifiers via web-based mapping platforms, and includes the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. Vendor attribution in the supplied corpus is low-confidence and marked for review; no additional product details should be assumed beyond EV2GO ev2go.io vers:all/*.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22890 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22890

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22890 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22890

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-057-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.