Everest CVE-2026-26070

The CVSS 4.6 score with vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a physically proximate attack vector (AV:P - physical access to the charging station or its network), low attack complexity, no privilege requirement, no user interaction, and high availability impact with no confidentiality or integrity impact. However, SSVC decision framework data indicates Exploitation: none (no confirmed active exploitation), Automatable: no (manual interaction required to coordinate concurrent updates), and Technical Impact: partial (denial of service only, not full system compromise). The absence of confirmed public exploits and CISA KEV status, combined with automatable=no and AV:P constraints, suggests this is a moderate practical risk for deployed infrastructure. Organizations must weigh the high availability impact (charging service disruption) against the requirement for physical proximity and deliberate timing of concurrent operations. Real-world priority depends on deployment: critical for public charging networks, lower priority for isolated/monitored installations.

An attacker with physical access to a charging station (or compromised network access to its control plane) could deliberately trigger a data race by simultaneously initiating an EV state-of-charge read, forcing a power meter periodic update cycle, and unplugging the vehicle or sending a SessionFinished command. This requires precise timing and knowledge of internal thread scheduling, but no elevated privileges. The resulting map corruption causes the charging stack to crash or enter an undefined state, denying service to legitimate users until manual recovery or automatic watchdog restart occurs. Attack complexity is non-trivial (automatable=no), making opportunistic exploitation unlikely; however, targeted denial of service against critical charging infrastructure is plausible.