What is the CVSS score of CVE-2026-26074?

CVE-2026-26074 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by CVE-2026-26074?

CVE-2026-26074 affects EVerest-core EV charging software, allowing remote attackers to corrupt critical data structures and cause information disclosure or service disruption when specific charging…. A patch is available.

How to fix or mitigate CVE-2026-26074?

Within 24 hours: Inventory all systems running EVerest-core and identify currently deployed versions (pre-2026.02.0 are vulnerable). Within 7 days: Develop and test upgrade path to EVerest-core version 2026.02.0 or later in non-production environment; assess operational impact of patching on charging network availability. Within 30 days: Apply vendor patch (EVerest-core 2026.02.0+) to all vulnerable instances, prioritizing production CSMS and EVSE systems; validate firmware update and logging functions post-deployment.

Everest CVE-2026-26074

EUVD-2026-16218 HIGH

Race Condition (CWE-362)

2026-03-26 GitHub_M

Information Disclosure Race Condition Everest Everest Core

7.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.0 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16218

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:19 nvd

HIGH 7.0

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible std::map<std::queue> corruption. The trigger is CSMS GetLog/UpdateFirmware request (network) with an EVSE fault event (physical). This results in TSAN reports concurrent access (data race) to event_queue. Version 2026.2.0 contains a patch.

AnalysisAI

Concurrent access to an internal event queue in EVerest-core (EV charging software stack) enables remote attackers to corrupt critical data structures when CSMS GetLog or UpdateFirmware requests coincide with EVSE fault events, potentially causing information disclosure, data integrity issues, and high availability impact. The vulnerability affects all versions prior to 2026.02.0, for which a vendor patch is available. SSVC analysis indicates no current exploitation, non-automatable attack surface, and partial technical impact. EPSS data not provided; no public exploit identified at time of analysis.

Technical ContextAI

EVerest-core (cpe:2.3:a:everest:everest-core) is an open-source software stack for electric vehicle charging infrastructure, managing communication between charging stations and central management systems (CSMS). The vulnerability is a classic race condition (CWE-362) where simultaneous network-triggered administrative commands (GetLog, UpdateFirmware via CSMS protocol) and physical hardware events (EVSE faults) cause unsynchronized access to a shared std::map containing std::queue objects. Thread Sanitizer (TSAN) tooling detected the concurrent writes to the event_queue data structure. Without proper mutex protection or atomic operations, this data race can corrupt the C++ Standard Template Library containers, leading to unpredictable behavior including memory corruption, leaked sensitive log data, or denial of service when the queue state becomes inconsistent.

RemediationAI

Upgrade EVerest everest-core to version 2026.02.0 or later, which contains a vendor-released patch addressing the data race condition (see GitHub advisory GHSA-p3hg-vqgv-h524 at https://github.com/EVerest/EVerest/security/advisories/GHSA-p3hg-vqgv-h524). Until patching is possible, implement network segmentation to restrict CSMS protocol access to trusted management networks only, reducing exposure to unauthenticated remote attackers. Monitor charging stations for anomalous behavior including unexpected restarts or log corruption following GetLog or UpdateFirmware operations coinciding with hardware fault events. Consider rate-limiting CSMS administrative commands during peak operational periods when EVSE faults are more probable. For critical infrastructure deployments, test the patch in non-production environments first to validate compatibility with existing CSMS integrations.