What is the CVSS score of CVE-2026-20744?

CVE-2026-20744 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Le Circuit Electrique Charging Station Backend CVE-2026-20744

Q: Which versions of Le Circuit Electrique Charging Station Backend are affected by CVE-2026-20744?

Hydro-Québec's Le Circuit Électrique EV charging platform contains a critical authentication bypass (CVSS 9.3) enabling unauthenticated remote compromise of all backend systems.

Q: How to fix or mitigate CVE-2026-20744?

Within 24 hours: Identify all Hydro-Québec Le Circuit Électrique backend instances and confirm deployed versions-flag any pre-June 2026 releases as critical. Within 7 days: Deploy Hydro-Québec's post-June 2026 backend patch to all affected systems; isolate charging-station backends from untrusted networks pending patching. Within 30 days: Complete upgrade verification, validate WebSocket endpoint access controls, and audit all backend administrative activities since deployment.

EUVD-2026-43094 CRITICAL

Improper Access Control (CWE-284)

2026-07-10 icscert

GHSA-v4hh-p8gf-c722

Authentication Bypass Privilege Escalation Le Circuit Electrique Charging Station Backend Hydro Qu Bec

9.3

CVSS 4.0 · Vendor: icscert

View

Vulnerability Assessment

Weakness

CWE

CWE-284

OWASP Top 10:2025

A01:2025 - Broken Access Control

ASVS 5.0

V8 - Authorization Access control enforcement

MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Emergency Immediate action required. Why: CRITICAL + active threat signals, no patch available.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 10, 2026

Authentication bypass in the Hydro-Québec Le Circuit Électrique EV charging station backend lets remote unauthenticated attackers open connections directly to the charging-station WebSocket endpoint, which lacks proper access control (CWE-284), and leverage that access for privilege escalation. All backend versions prior to the June 2026 fix are affected, and the CVSS 4.0 base score of 9.3 (critical) reflects full compromise of confidentiality, integrity, and availability over the network with no privileges or user interaction. Reported through CISA ICS-CERT (ICSA-26-188-01); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Earlier versions of this analysis (2)

v2 Jul 10, 2026 - 23:28 cvss changed CVSS 9.3

Authentication bypass in the Hydro-Québec Le Circuit Électrique charging station backend allows remote attackers to connect to the charging station WebSocket endpoint without any credentials and escalate privileges. All backend versions prior to the June 2026 release are affected. Rated CVSS 4.0 9.3 (Critical) and reported through CISA ICS-CERT; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

v1 Jul 10, 2026 - 22:55 CVSS 9.8

Authentication bypass in Hydro-Québec's Le Circuit Électrique EV charging station backend allows remote unauthenticated attackers to open WebSocket connections that should require authentication, opening a path to privilege escalation over the charging infrastructure. The flaw carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and was disclosed via CISA ICS advisory ICSA-26-188-01. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS score was provided.

Affected VersionsENISA

Le Circuit Electrique charging station backend 0 <June_2026

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Le Circuit Electrique Charging Station Backend gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (icscert) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 9.8 CRITICAL

Remote unauthenticated access to a WebSocket endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N) and privilege escalation yielding full control of backend operations gives high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 23:28 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 10, 2026 - 23:28 vuln.today

v2 - CVSS changed

CVSS changed

Jul 10, 2026 - 23:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.

Executive ViewAI

Why It Matters

Hydro-Québec's Le Circuit Électrique EV charging platform contains a critical authentication bypass (CVSS 9.3) enabling unauthenticated remote compromise of all backend systems. Organizations operating this charging infrastructure face immediate risk of service disruption, customer data exposure, and operational takeover; the vulnerability affects all pre-June 2026 backend deployments.

Recommended Action

Within 24 hours: Identify all Hydro-Québec Le Circuit Électrique backend instances and confirm deployed versions-flag any pre-June 2026 releases as critical. Within 7 days: Deploy Hydro-Québec's post-June 2026 backend patch to all affected systems; isolate charging-station backends from untrusted networks pending patching. Within 30 days: Complete upgrade verification, validate WebSocket endpoint access controls, and audit all backend administrative activities since deployment.

Business Impact: Severe

Compensating Controls

Apply vendor patch (upgrade to Hydro-Québec Le Circuit Électrique backend versions released after June 2026). Interim mitigations: network segmentation isolating backend from internet-facing infrastructure, ingress firewall rules restricting WebSocket endpoint access to authorized operators, real-time monitoring for unauthorized connection attempts to backend services.

Threat Intelligence Overview

EPSS Score

0.5%

Top 60% exploitable

Threat Intel

1 source

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CISA CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + active threat signals, no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.