CVE-2026-27767 is a critical missing authentication flaw (CVSS 9.4) in the SWTCH EV charging backend. Its OCPP WebSocket endpoint accepts connections without authentication. CISA lists all versions as affected. SWTCH describes vendor-side mitigations. The record does not mark it as a CISA Known Exploited Vulnerability.
What's affected
SWTCH EV swtchenergy.com, all versions, per CISA advisory ICSA-26-057-06.
CISA lists all versions of swtchenergy.com as affected. There is no fixed version number to install, because the fix is a vendor-side change to the service and a policy rollout to chargers.
This is a hosted backend for electric vehicle charging. If you are a charge point operator or site owner whose chargers talk to it, the exposure is yours even though the code is the vendor's.
How to check if you're exposed
There is no version to look up. Work through these instead.
- Ask the vendor whether your chargers connect to the affected endpoint and what the current state of enforcement is.
- Look at your charger configuration for the backend address and the identifier each charger uses to connect.
- Check your own network logs for connections to that endpoint from addresses that are not your chargers.
The advisory notes that an attacker needs a known or discovered charging station identifier, so treat those identifiers as semi-public.
What to do now
- Read the SWTCH security portal and the CISA advisory, and contact SWTCH through its contact page to learn the state of your chargers.
- Ask which of your chargers still run firmware that cannot enforce the new connection checks, and plan upgrades or retirement for them.
- Restrict network paths to the backend where you can, using allow lists for the sources your chargers use.
- Watch charger session and status data for stations that appear to connect from unexpected places or report impossible readings.
Why it matters
The record says the WebSocket endpoint lacks authentication, so a client that knows or guesses a charging station identifier can connect and send or receive OCPP commands as that charger. CISA warns of station impersonation, hijacked sessions, misrouted or suppressed traffic and corrupted data sent to the backend. NVD classifies the flaw as CWE-306 (Missing Authentication for Critical Function).
SWTCH Energy says it has applied configuration changes that enforce security checks on initial connections from untrusted chargers, and that it applies compensating controls such as monitoring and IP-based restrictions. The advisory adds that for some chargers in the field, full enforcement depends on legacy firmware and TLS compatibility limits.
OCPP is the protocol chargers use to talk to their management backend. When identity is only a station name, the name is not a secret and cannot protect anything.
Quick check
What is the risk to drivers?
The advisory describes unauthorized control of charging infrastructure, impersonation of stations and corrupted backend data, and denial of service. It does not describe harm to vehicles.
Is there a patch I can install?
CISA lists all versions as affected and describes vendor-side configuration changes and compensating controls. Contact the vendor for the status of your chargers.
Sources
Last reviewed: 19 October 2026.
