CVE-2026-26288 is a critical flaw (CVSS 9.4) in the Everon OCPP backend: its WebSocket endpoints require no authentication, so anyone with a charger identifier can act as that charger. CISA reports that Everon shut down its platform on 1 December 2025, so there is no fix. Move any chargers off it.
What's affected
The CISA advisory ICSA-26-062-08 and the NVD record name the Everon OCPP backend (the record lists api.everon.io) as affected. No version numbers apply here, because this is a hosted service and not software you install.
CISA's remediation entry says only that Everon shut down its platform on 1 December 2025. There is no patch to apply.
The advisory covers energy and transportation systems, and lists Everon's headquarters in the Netherlands.
How to check if you're exposed
Work out whether any charge point still points at this backend. In the charger's configuration or the management tool you use, look for the central system URL, which will be a WebSocket address starting with ws:// or wss://. Search it for everon.
If you are a site host or a charge point operator, ask your hardware or service provider where your chargers send their data today.
You can also check your network logs or DNS logs for lookups of the Everon API host. Any chargers still trying to reach it are either on a dead service or on something that should be retired.
What to do now
- List every charger that was ever connected to the Everon backend and confirm what each one connects to now.
- Move chargers to a supported backend and confirm the new backend authenticates charge points before you cut over.
- Ask the new provider which OCPP security profile they support. The OCPP standard defines profiles that use passwords or client certificates for charge point authentication. This is general OCPP guidance, not a statement from the advisory.
- Keep charger management networks separate from business networks and block inbound access you do not need.
- Remove the old backend address from charger configuration once the migration is done, so no device keeps talking to a retired endpoint.
Why it matters
The weakness is CWE-306, missing authentication for a critical function. In OCPP, the protocol that lets chargers talk to a central system, a charger identifies itself with an identifier. If the backend accepts any connection that quotes a known or guessed identifier, the identifier acts as the only credential.
Per the advisory, an unauthenticated attacker can connect with a known or discovered identifier, then send or receive OCPP commands as if they were the charger. That can lead to unauthorized control of charging equipment and to corrupted data in the charging network's backend. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
The record is not on the CISA Known Exploited Vulnerabilities list. The situation is unusual, because the vendor has stopped operating the service. The risk now is in what you still have pointed at it.
Quick check
Is there a patch for CVE-2026-26288?
No. CISA's advisory says Everon shut down its platform on 1 December 2025. The action is to migrate.
Is this exploited in the wild?
The record's KEV flag is false, and the advisory does not say it is exploited.
Sources
Last reviewed: 19 October 2026.
