Home / Vulnerability Intelligence / CVE-2026-27772

CVE-2026-27772 - Vulnerability Analysis

CriticalCVSS: 9.4

Last Updated: March 2, 2026

OCPP WebSocket - Authentication Bypass

Published: February 27, 2026Updated: March 2, 2026Remote Exploitable

Overview

OCPP WebSocket endpoints contain an authentication bypass caused by lack of proper authentication mechanisms, letting unauthenticated attackers impersonate stations and manipulate backend data, exploit requires no authentication.

Severity & Score

Severity: Critical

CVSS Score: 9.4

EPSS Score: 13.2%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can control charging infrastructure, escalate privileges, and corrupt backend charging network data.

Mitigation

Implement proper authentication mechanisms on WebSocket endpoints to prevent unauthorized access.

References

Social Media Activity(2 posts)

BeyondMachines :verified:

@beyondmachines1

Feb 27, 2026

Multiple Vulnerabilities Reported in EV Energy Charging Platform EV Energy's charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-27772), that allow attackers to hijack electric vehicle charging stations and disrupt energy infrastructure. **Make sure to isolate EV Energy systems from the public internet and use a VPN for any required remote management. Since the vendor hasn't released a patch, this is your only defense until you replace these systems.** #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/critical-vulnerabilities-in-ev-energy-charging-platform-allow-remote-hijacking-b-x-t-d-l/gD2P6Ple2L

View original post

TheHackerWire

@thehackerwire

Feb 27, 2026

🔴 CVE-2026-27772 - Critical (9.4) WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27772/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

Details

CVE ID: CVE-2026-27772
Severity: Critical
CVSS Score: 9.4
Type: broken_authentication
Status: confirmed
EPSS: 13.2%
Social Posts: 2

CWE

CWE-306

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS Score

13.2%Probability of exploitation in the next 30 days