{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27814", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:31:33.268Z", "datePublished": "2026-03-26T16:27:54.306Z", "dateUpdated": "2026-03-26T18:50:34.592Z"}, "containers": {"cna": {"title": "EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557"}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"version": "< 2026.02.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T16:27:54.306Z"}, "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase \u2194 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch."}], "source": {"advisory": "GHSA-5528-wc53-v557", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T18:50:27.710064Z", "id": "CVE-2026-27814", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:50:34.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27814", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T18:50:27.710064Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T18:50:31.598Z"}}], "cna": {"title": "EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition", "source": {"advisory": "GHSA-5528-wc53-v557", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "EVerest", "product": "everest-core", "versions": [{"status": "affected", "version": "< 2026.02.0"}]}], "references": [{"url": "https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557", "name": "https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase \u2194 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T16:27:54.306Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27814", "state": "PUBLISHED", "dateUpdated": "2026-03-26T18:50:34.592Z", "dateReserved": "2026-02-24T02:31:33.268Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T16:27:54.306Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase \u2194 3-phase switch request (`ac_switch_three_phases_while_charging`) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch."}, {"lang": "es", "value": "EVerest es una pila de software de carga de veh\u00edculos el\u00e9ctricos. Las versiones anteriores a la 2026.02.0 tienen una condici\u00f3n de carrera de datos (C++ UB) desencadenada por una solicitud de un switch A de 1 fase ? 3 fases (`ac_switch_three_phases_while_charging`) durante la carga/espera que se ejecuta concurrentemente con el bucle de la m\u00e1quina de estados. La versi\u00f3n 2026.02.0 contiene un parche."}], "id": "CVE-2026-27814", "lastModified": "2026-03-30T13:26:50.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-26T17:16:33.910", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/EVerest/EVerest/security/advisories/GHSA-5528-wc53-v557"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.02.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "everest-core", "source": "cna", "vendor": "EVerest"}, "product": "everest-core", "vendor": "everest"}], "analysis": {"en": {"generated_at": "2026-03-26T17:23:12.158470+00:00", "value": {"mitigation_remediation": ["Update everest-core to version 2026.02.0 or later."], "summary": {"action": "Apply patch", "impact": "Race condition leading to undefined behavior"}, "threat_synthesis": {"affected_systems": "The flaw exists in the EVerest everest-core product in all releases dated before 2026.02.0. Versions 2026.02.0 and later include a patch that eliminates the race condition.", "description_and_impact": "EVerest\u2019s EvseManager contains an unsynchronized shared-state access race condition that occurs when an A 1-phase to 3-phase switch request is issued while the station is either charging or waiting. The race triggers undefined behavior in the C++ code, which can manifest as inconsistent internal state or application crashes, potentially affecting the charging process or system reliability.", "risk_and_exploitability": "The CVSS score is 4.2, indicating low severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require successfully issuing the phase\u2011switch command during a charging or waiting state, likely via the EVSE\u2019s network interface or control channel; this is inferred from the description and not explicitly stated in the advisory. Because the data race can lead to undefined behavior, the exact impact is uncertain, but the risk of exploitation remains low to moderate under normal operational conditions."}}}}, "created": "2026-03-27T08:33:54.055966+00:00", "updated": "2026-03-27T09:26:20.201434+00:00", "vendors": ["everest", "everest$PRODUCT$everest-core"]}