CVE-2026-24003

EVerest is an EV charging software stack. In versions up to and including 2025.12.1, it is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context with illegitimate data.cThanks to the modular design of EVerest, authorization is handled in a separate module and EVSEManager Charger internal state machine cannot transition out of the `WaitingForAuthentication` state through ISO 15118-2 communication. From this state, it was however possible through ISO 15118-2 messages which are published to the MQTT server to trick it into preparing to charge, and even to prepare to send current. The final requirement to actually send current to the EV was the closure of the contactors, which does not appear to be possible without leaving the `WaitingForAuthentication` state and leveraging ISO 15118-2 messages. As of time of publication, no fixed versions are available.

• CWE-287
• CWE-863

• https://github.com/EVerest/everest-core/blob/main/modules/EVSE/EvseV2G/iso_server.cpp#L44Product
• https://github.com/EVerest/everest-core/security/advisories/GHSA-9vv5-67cv-9crqMitigation, Vendor Advisory

Published

Jan 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23998Fleet is open source device management software. Prior to ve…7.5
• CVE-2026-23999Fleet is open source device management software. In versions…5.5
• CVE-2026-2400CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Inje…4.3
• CVE-2026-24000Fleet is open source device management software. Prior to ve…5.3
• CVE-2026-24001jsdiff is a JavaScript text differencing implementation. Pri…7.5
• CVE-2026-24002Grist is spreadsheet software using Python as its formula la…9.6
• CVE-2026-24004Fleet is open source device management software. In versions…5.3
• CVE-2026-24005Kruise provides automated management of large-scale applicat…7.6
• CVE-2026-24006Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-24007Tuleap is an Open Source Suite for management of software de…4.6
• CVE-2026-24009Docling Core (or docling-core) is a library that defines cor…9.8
• CVE-2026-2401CWE-532 Insertion of Sensitive Information into Log File vul…5