What is the CVSS score of EUVD-2026-16201?

EUVD-2026-16201 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Everest are affected by EUVD-2026-16201?

CVE-2026-26008 affects EVerest EV charging software versions before 2026.02.0, allowing unauthenticated remote attackers to crash charging stations or corrupt memory through malformed messages from…. A patch is available.

How to fix or mitigate EUVD-2026-16201?

Within 24 hours: Inventory all EVerest everest-core deployments and identify instances running versions before 2026.02.0; assess network segmentation between CSMS and charging stations. Within 7 days: Upgrade all affected EVerest everest-core instances to version 2026.02.0 or later per vendor advisory. Within 30 days: Conduct post-patch validation testing; implement network monitoring for anomalous UpdateAllowedEnergyTransferModes messages; review CSMS access controls and logging.

Everest EUVD-2026-16201

| CVE-2026-26008 HIGH

Out-of-bounds Read (CWE-125)

2026-03-26 GitHub_M

Buffer Overflow Information Disclosure Everest Everest Core

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 15:00 euvd

EUVD-2026-16201

Analysis Generated

Mar 26, 2026 - 15:00 vuln.today

CVE Published

Mar 26, 2026 - 14:43 nvd

HIGH 7.5

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the network. Version 2026.2.0 contains a patch.

AnalysisAI

Out-of-bounds vector access in EVerest EV charging software (everest-core versions before 2026.02.0) enables remote unauthenticated attackers to crash the charging station software or corrupt memory by sending crafted UpdateAllowedEnergyTransferModes messages from a Charging Station Management System (CSMS). CVSS 7.5 severity reflects network-accessible denial of service with high availability impact. SSVC assessment indicates no current exploitation and non-automatable attack; no public exploit identified at time of analysis.

Technical ContextAI

EVerest is an open-source software stack for electric vehicle charging infrastructure that communicates with Charging Station Management Systems (CSMS) over OCPP (Open Charge Point Protocol). The vulnerability stems from CWE-125 (Out-of-bounds Read) occurring during processing of UpdateAllowedEnergyTransferModes messages, which can trigger std::vector boundary violations. Affected product is everest-core (CPE: cpe:2.3:a:everest:everest-core:*:*:*:*:*:*:*:*) across all versions prior to 2026.02.0. The network-facing nature of CSMS communication expands attack surface to any entity capable of sending OCPP messages to the charging station software, making this a critical infrastructure vulnerability in EV charging deployments.

RemediationAI

Upgrade everest-core to version 2026.02.0 or later, which contains the vendor-released patch for this vulnerability as documented in the GitHub security advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-vw95-6jj7-3fv9. Until patching is feasible, implement network segmentation to restrict CSMS communication to authenticated and trusted management systems only, deploy intrusion detection rules to monitor for malformed UpdateAllowedEnergyTransferModes messages, and consider rate-limiting OCPP message processing. Organizations should validate that update deployment does not disrupt charging operations by testing in non-production environments first. Monitor EVerest project releases and the referenced GitHub advisory for additional security guidance specific to EV charging infrastructure hardening.