What is the CVSS score of EUVD-2026-16222?

EUVD-2026-16222 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Everest Core are affected by EUVD-2026-16222?

Organizations using EVerest should be aware of moderate risk from CVE-2026-27814, a race condition vulnerability rated CVSS 4.2. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-16222?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Everest Core EUVD-2026-16222

| CVE-2026-27814 MEDIUM

Race Condition (CWE-362)

2026-03-26 GitHub_M

Information Disclosure Race Condition Everest Core

4.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.2 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.02.0

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16222

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:27 nvd

MEDIUM 4.2

DescriptionGitHub Advisory

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (ac_switch_three_phases_while_charging) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.

AnalysisAI

Data race conditions in EVerest Core versions before 2026.02.0 allow concurrent access to charging state during phase switching operations, potentially causing integrity violations or service interruptions on affected EV charging systems. An attacker with adjacent network access can trigger the race condition by initiating phase switches during active charging sessions, exploiting the unsafe concurrent execution between the state machine and switching requests. No patch is currently available for this vulnerability.

Technical ContextAI

EVerest is a software platform for EV charging infrastructure that manages complex state machines for charging sessions and power delivery. The vulnerability root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), specifically a race condition in the C++ codebase. The affected component handles AC phase switching (ac_switch_three_phases_while_charging) which operates concurrently with the main state machine loop. Without proper mutex or synchronization primitives protecting shared state during the 1-phase to 3-phase mode transition, multiple threads can read and write charging state variables simultaneously, leading to undefined behavior such as memory corruption, inconsistent state, or unexpected state machine transitions. CPE cpe:2.3:a:everest:everest-core identifies all affected versions prior to 2026.02.0.

RemediationAI

Upgrade EVerest-Core to version 2026.02.0 or later immediately. The vendor has released a patched version (Vendor-released patch: 2026.02.0) that resolves the data race condition through proper synchronization of the phase-switching code path. Until patching is possible, operators should restrict network access to the EVerest control plane and state machine interfaces to trusted administrative networks only, and avoid issuing phase-switching requests during active charging sessions where feasible. Consult the EVerest project security advisory at https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557 for deployment-specific guidance and confirmation of patched releases.