CVE-2026-26290 is a high severity flaw (CVSS 7.3) in the ev.energy charging backend. It accepts several connections that use the same charging station identifier, so the newest connection displaces the real charger. CISA says the vendor did not respond, so no fix is listed. Contact ev.energy and watch for duplicate sessions.
What's affected
The CISA advisory ICSA-26-057-07 and the NVD record name ev.energy as the affected product. It is a hosted backend service, so there is no version number you install or patch.
The remediation entry in CISA's data says ev.energy did not respond to CISA's request for coordination and points readers to the company's contact page. No fix or workaround is published in the sources we checked.
How to check if you're exposed
If you operate chargers that connect to the ev.energy backend, or you build on that service, review the connection logs you can see. Look for the same charger identifier appearing in overlapping or alternating sessions, or for a charger that goes quiet while the backend still shows it as connected.
Also check how your chargers are configured. Note whether the WebSocket address uses wss://, and what credentials, if any, the charger presents.
If you have no visibility into backend logs, ask the provider whether they log duplicate registrations and whether they can alert you.
What to do now
- Contact ev.energy through its published contact page and ask for the status of a fix. Keep the reply.
- Ask whether the backend now rejects a second connection that uses an identifier already in use, or requires a credential per charger.
- Monitor for duplicate charger sessions and unexpected disconnects, and alert on them.
- Use charge point credentials that are not guessable if the platform supports them, and keep charger identifiers out of public documents.
- Plan for an alternative provider if the vendor cannot give you a timeline.
Why it matters
The weakness is CWE-613, insufficient session expiration. The record describes a related design problem: the backend uses the charging station identifier to tie a session to a charger, but lets more than one endpoint use the same identifier. Because the identifiers are predictable, an attacker can connect with one, and the most recent connection replaces the legitimate charger and receives the commands meant for it.
The record says this may let someone authenticate as another user, or cause denial of service by flooding the backend with valid session requests. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: remote, no login, low impact on each of confidentiality, integrity and availability.
The record is not on the CISA Known Exploited Vulnerabilities list. It is one of several records in the same CISA advisory.
Quick check
Is CVE-2026-26290 fixed?
No fix is listed. CISA says the vendor did not respond to its coordination request.
What should a charger operator do?
Contact the vendor, monitor for duplicate sessions, and keep charger identifiers private while you wait for an answer.
Sources
Last reviewed: 19 October 2026.
