PT-2026-28362 · Everest · Everest

Secmate · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-27828

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0

Description EVerest is an EV charging software stack. The ISO15118 chargerImpl::handle session setup function uses the v2g ctx variable after it has been freed when ISO15118 initialization fails, such as when there is no IPv6 link-local address. An attacker with MQTT access can remotely crash the EVSE process by issuing a session setup command while v2g ctx has been released. The vulnerable function is handle session setup. The MQTT protocol is used for communication.

Recommendations Update to version 2026.02.0 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-27828

GHSA-5G3V-QC79-QQWR

Affected Products

Everest

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27828.json · Exploit
• https://github.com/EVerest/EVerest/security/advisories/GHSA-5g3v-qc79-qqwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27828 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27828 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037513436985217500 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037515536058208447 · Twitter Post