CVE-2026-27772 is a critical missing authentication flaw (CVSS 9.4) in the EV Energy charging backend. Its OCPP WebSocket endpoint accepts connections without authentication. CISA lists all versions as affected. CISA lists no fix. The record does not mark it as a CISA Known Exploited Vulnerability.
What's affected
EV Energy ev.energy, all versions, per CISA advisory ICSA-26-057-07.
CISA lists all versions of ev.energy as affected. The advisory lists no fix.
This is a hosted backend for electric vehicle charging. If you are a charge point operator or site owner whose chargers talk to it, the exposure is yours even though the code is the vendor's.
How to check if you're exposed
There is no version to look up. Work through these instead.
- Ask the vendor whether your chargers connect to the affected endpoint and what the current state of enforcement is.
- Look at your charger configuration for the backend address and the identifier each charger uses to connect.
- Check your own network logs for connections to that endpoint from addresses that are not your chargers.
The advisory notes that an attacker needs a known or discovered charging station identifier, so treat those identifiers as semi-public.
What to do now
- Contact EV Energy through its contact page and ask for the vendor's position on this CVE and a fix timeline.
- Where you operate chargers connected to this backend, limit network exposure with allow lists and monitoring on the paths chargers use.
- Review charger and backend data for stations that connect from unexpected places or report inconsistent data.
- Record the exposure in your risk register until the vendor provides a fix, and set a date to ask again.
Why it matters
The record says the WebSocket endpoint lacks authentication, so a client that knows or guesses a charging station identifier can connect and send or receive OCPP commands as that charger. CISA warns of station impersonation, hijacked sessions, misrouted or suppressed traffic and corrupted data sent to the backend. NVD classifies the flaw as CWE-306 (Missing Authentication for Critical Function).
CISA states that EV Energy did not respond to its request for coordination, and points readers to the vendor's contact page. There is no vendor fix listed in the advisory.
OCPP is the protocol chargers use to talk to their management backend. When identity is only a station name, the name is not a secret and cannot protect anything.
Quick check
What is the risk to drivers?
The advisory describes unauthorized control of charging infrastructure, impersonation of stations and corrupted backend data, and denial of service. It does not describe harm to vehicles.
Is there a patch?
The CISA advisory lists no vendor fix and says the vendor did not respond to coordination requests.
Sources
Last reviewed: 19 October 2026.
