What is the CVSS score of CVE-2026-26072?

CVE-2026-26072 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-26072?

Organizations using EVerest should be aware of moderate risk from CVE-2026-26072, a race condition vulnerability rated CVSS 4.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-26072?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest CVE-2026-26072

EUVD-2026-16207 MEDIUM

Race Condition (CWE-362)

2026-03-26 security-advisories@github.com

Race Condition Information Disclosure Everest

4.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.2 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 15:22 euvd

EUVD-2026-16207

Analysis Generated

Mar 26, 2026 - 15:22 vuln.today

CVE Published

Mar 26, 2026 - 15:16 nvd

MEDIUM 4.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to std::map<std::optional> concurrent access (container/optional corruption possible). The trigger is EV SoC update with powermeter periodic update and unplugging/SessionFinished status. Version 2026.02.0 patches the issue.

AnalysisAI

EVerest EV charging software prior to version 2026.02.0 contains a race condition in concurrent map access that can corrupt internal data structures when EV state-of-charge updates coincide with power meter refreshes and session termination events. Local attackers with physical access to charging equipment can trigger this condition to cause denial of service by crashing the charging system. Patch availability is limited to version 2026.02.0 and later.

Technical ContextAI

The vulnerability is rooted in CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), a race condition affecting concurrent access to a std::map container holding std::optional elements. In EVerest, this manifests when three concurrent operations occur without proper locking: EV state-of-charge (SoC) updates from the vehicle, periodic power meter readings from connected hardware, and session state transitions (unplugging events or SessionFinished status changes). The std::map and std::optional types lack internal thread-safety guarantees in standard C++ libraries, and unsynchronized concurrent modification can lead to iterator invalidation, container corruption, and undefined behavior. EVerest is identified via affected version everest-core < 2026.02.0, indicating this is the core EV charging orchestration component.

RemediationAI

Upgrade EVerest to version 2026.02.0 or later to obtain the patch that resolves the std::map<std::optional> race condition. Until patching is feasible, restrict physical access to charging stations and power meter hardware to authorized personnel only, reducing the likelihood of triggering the concurrent SoC update, power meter periodic read, and session termination conditions simultaneously. Implement monitoring and logging of session state transitions and power meter events to detect unexpected container corruption or state machine anomalies. Consult the official GitHub security advisory (https://github.com/EVerest/EVerest/security/advisories/GHSA-9xwc-49c4-p79v) for detailed deployment guidance and any configuration hardening recommendations from the EVerest maintainers.