Everest CVE-2026-26072

The CVSS vector CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates this requires physical attack vector (P) and high complexity (H), limiting the practical exploitability surface significantly. CISA's SSVC framework assessment shows exploitation status as none, automatable as no, and technical impact as partial, strongly aligning with the low real-world risk despite high availability impact. The vulnerability does not cause remote code execution, information disclosure, or data integrity compromise-only denial of service through container/state corruption. Absence of KEV status and public exploit code further supports that this is a lower-priority issue than the raw CVSS score suggests. Organizations operating EVerest in controlled, physical-access-restricted environments face minimal risk; however, facilities with less stringent access controls should prioritize patching.

An attacker with physical access to an EVerest charging station could rapidly plug/unplug an EV while simultaneously inducing rapid state-of-charge updates (via custom EV firmware or a crafted CAN message on the charging controller bus) and forcing power meter updates to occur at the same instant, causing unsynchronized concurrent modification of the shared std::map<std::optional> structure. This triggers a data race that corrupts the container state, causing the charging session logic to crash or enter an undefined state, resulting in denial of service. Given the high complexity requirement and physical access prerequisite, this scenario is unlikely in public charging networks but plausible in less-controlled environments such as fleet depots or private charging installations.