VulnSocial

CVE-2026-26288Disclosure(everon / api.everon.io)

LOWCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Prioritize remediation for everon api.everon.io systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend.

everon CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-306

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • api.everon.io

Threat summary

  • Active exploitation appears in 1 classified signals
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 4 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 2 mentions (2026-03-06); latest day: 2
  • 6 total mentions across 4 days

Affected systems

Vendors
everon
Products
api.everon.io

Deep dive

Activity timeline6 mentions / 4d
01122Mentions · 2026-03-05: 1Mentions · 2026-03-06: 2Mentions · 2026-03-07: 1Mentions · 2026-05-11: 2Active Exploitation · 2026-03-05: 1Technical Details · 2026-03-05: 1Technical Details · 2026-03-06: 2Technical Details · 2026-03-07: 1Technical Details · 2026-05-11: 103-0503-0603-0705-11
Signal classification3 categories
Disclosure
466.7%
Active Exploitation
116.7%
General
116.7%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-03-051
Active Exploitation1
2026-03-062
Disclosure2
2026-03-071
Disclosure1
2026-05-112
Disclosure1General1
Full discourse6 posts
  • Gray Hats@the_yellow_fall
    Active Exploitation

    Critical authentication flaws (CVE-2026-26288) in Everon's OCPP backend allowed hackers to hijack EV chargers, forcing a complete platform shutdown. #EVSecurity #CyberSecurity #Everon #OCPP #CVE202626288 #InfoSec #ThreatIntel #SmartGrid #Vulnerability https://securityonline.info/ev-charging-grid-alert-critical-flaws-exposed-in-everon-ocpp-backends/

    Post summary

    The text reports that authentication flaws in Everon's OCPP backend have been actively exploited, enabling hackers to hijack EV chargers and shut down the platform.

    01053302
    10.5K followersView on X
  • Lyrie.ai@lyrie_ai
    Disclosure

    Unpopular opinion: The cybersecurity industry is selling you dashboards. CVE: CVE-2026-26288 CVSS: 9.4 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Severity: CRITICAL Status: Critical advisory

    Post summary

    The text announces a new critical vulnerability (CVE-2026-26288) with a high CVSS score, but provides no PoC, exploit, mitigation, or evidence of active exploitation.

    1000022
    197 followersView on X
  • Lyrie.ai@lyrie_ai
    General

    https://lyrie.ai/research/research/cve-2026-26288-everon-api-everon-io #lyrie #cybersecurity #CVE #threatintel #zerodayattack

    Post summary

    The provided text links to a research page about CVE-2026-26288 but contains no explicit details, indicators, or claims beyond a URL and hashtags.

    0000016
    188 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-26288 - Critical WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated att... https://www.thehackerwire.com/vulnerability/CVE-2026-26288/ https://t.co/Z3S6taPRRX

    Post summary

    A new critical vulnerability (CVE-2026-26288) has been disclosed in WebSocket endpoints, allowing attackers to impersonate stations and manipulate backend data.

    0000042
    128 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-26288 WebSocket Authentication Bypass in OCPP Charging Station Management System https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26288

    Post summary

    The brief entry announces a new authentication bypass vulnerability in OCPP charging station management systems, providing a link to details but no PoC, exploit, or mitigation information.

    0000037
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-26288 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. A… https://www.cve.org/CVERecord?id=CVE-2026-26288

    Post summary

    The vulnerability describes missing authentication on WebSocket endpoints, enabling attacker impersonation and data manipulation.

    0000077
    56.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appeveronapi.everon.io---

Explore more

Back to dashboardeveron CVEsapi.everon.io vulnerabilities