PT-2026-28350 · Everest · Everest

Finder16 · Published 2026-03-26 · Updated 2026-03-29 · CVE-2026-26072

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race condition that can lead to concurrent access to std::map<std::optional>, potentially causing container or optional corruption. The issue is triggered by an Electric Vehicle (EV) State of Charge (SoC) update combined with periodic power meter updates and the status of disconnection or session completion.

Recommendations Update to version 2026.02.0 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-26072

GHSA-9XWC-49C4-P79V

Affected Products

Everest

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26072.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-9xwc-49c4-p79v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26072 · Security Note
• https://twitter.com/CVEnew/status/2038135178116346156 · Twitter Post