PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-26288 Unknown Vendor CVE debrief

CVE-2026-26288 is an authentication failure in Everon’s OCPP backend WebSocket endpoints. CISA says an unauthenticated attacker who knows or discovers a charging-station identifier can connect as a legitimate charger, issue or receive OCPP commands, and corrupt backend data. The advisory was published on 2026-03-03, and its remediation note says Everon shut down its platform on 2025-12-01, which matters when assessing any remaining exposure.

Vendor
Unknown Vendor
Product
Everon api.everon.io vers:all/*
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-03
Original CVE updated
2026-03-03
Advisory published
2026-03-03
Advisory updated
2026-03-03

Who should care

Operators and integrators of EV charging infrastructure using Everon api.everon.io; OT/ICS security teams; SOC and incident-response teams; and anyone responsible for historical data, backend integrations, or inherited OCPP telemetry/control paths.

Technical summary

The advisory describes a network-reachable OCPP WebSocket endpoint with missing authentication (CWE-306). Because no authentication is required, a remote attacker can impersonate a charger by using a known or discovered station identifier and then interact with the backend as if it were a legitimate endpoint. CISA’s provided CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, reflecting high impact to confidentiality and integrity with some availability impact.

Defensive priority

Critical. A remotely reachable, unauthenticated control-plane weakness affecting charging infrastructure should be treated as urgent to validate, isolate, or retire.

Recommended defensive actions

  • Confirm whether any Everon OCPP WebSocket endpoint or dependent integration is still reachable; if so, isolate or disable it pending replacement.
  • Review backend logs for unknown charging-station identifiers, unusual OCPP session patterns, unexpected command traffic, and signs of data tampering.
  • Revoke or replace any station identifiers, trust material, keys, or credentials associated with affected integrations, where applicable.
  • Apply strict network segmentation and access controls around charging backends; require strong authentication for any replacement service or migration path.
  • Validate the integrity of charging-session, metering, and operational data collected during the exposure window and re-sync from trusted sources where possible.
  • Use CISA ICS recommended practices for monitoring, defense-in-depth, and incident handling around industrial control and charging systems.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-26-062-08 / CVE-2026-26288 and its listed references. The source states that WebSocket endpoints lacked proper authentication, enabling unauthorized station impersonation and backend manipulation. The advisory’s remediation note reports that Everon shut down its platform on 2025-12-01. The published advisory date is 2026-03-03; that date is used as the CVE publication context here.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-26288 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-26288

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-26288 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-26288

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-062-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-062-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.