CVE-2026-27814: EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition
Published Mar 26, 2026
·Updated
EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race (C++ UB) triggered by an A 1-phase ↔ 3-phase switch request (acswitchthreephaseswhilecharging) during charging/waiting executes concurrently with the state machine loop. Version 2026.02.0 contains a patch.
Affected Software
2 affected components
Everest EvseManager<2026.02.0
linuxfoundation Everest<2026.02.0
Event History
Mar 26, 2026
CVE Published
via MITRE·04:27 PM
Data Sourced
via MITRE·04:27 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-27814?
CVE-2026-27814 has not been assigned a severity level yet.
2
How do I fix CVE-2026-27814?
To fix CVE-2026-27814, update EVerest EvseManager to version 2026.02.0 or later.
3
What type of vulnerability is CVE-2026-27814?
CVE-2026-27814 is a race condition vulnerability in the EVerest EvseManager.
4
What versions are affected by CVE-2026-27814?
All versions of EVerest EvseManager prior to 2026.02.0 are affected by CVE-2026-27814.
5
What impact does CVE-2026-27814 have on the system?
CVE-2026-27814 can lead to undefined behavior due to unsynchronized shared-state access during phase-switch requests.