Everest CVE-2026-26073

While the CVSS score of 5.9 (Medium-High) reflects denial-of-service potential with high availability impact (CWE-122 heap corruption), real-world risk is moderated by several factors. The attack vector is network-based but attack complexity is explicitly rated HIGH, indicating reliable exploitation is not trivial-attackers must precisely time multiple concurrent events (powermeter key update coinciding with EV session errors) while OCPP initialization is in a specific state. CISA SSVC framework assessment confirms this nuance: exploitation status is NONE (no evidence of active attacks), automation difficulty is NO (cannot be fully automated), and technical impact is PARTIAL (availability degradation, not code execution or data exfiltration). No public exploit code or KEV listing is reported. The vulnerability represents a real but non-critical risk for deployed EV charging networks; it poses operational risk (potential service interruption) rather than data breach or remote code execution risk. Organizations running affected versions should prioritize patching to improve resilience, but this is not an emergency-level vulnerability.

An attacker with network access to an EV charging station running a vulnerable EVerest version could send a specially crafted sequence of events: initiating an EV session error condition while simultaneously triggering a powermeter public key update, all while the OCPP protocol handler remains uninitialized. The precise timing causes concurrent access to the same queue structure without proper synchronization, corrupting heap memory. This results in a denial-of-service condition as the charging software crashes with a runtime error. Successful exploitation requires trial-and-error timing or deep knowledge of the EVerest event loop internals; no public proof-of-concept is known to exist, explaining the HIGH attack complexity rating.