Threat Investigation
Request a demo

CVE-2026-33014

Medium

Description

EVerest is an EV charging software stack. Prior to version 2026.02.0, during RemoteStop processing, a delayed authorization response restores `authorized` back to true, defeating the `stop_transaction()` call condition on PowerOff events. As a result, the transaction can remain open even after a remote stop. Version 2026.02.0 contains a patch.

SeverityMedium
CVSS5.2
Exploit probability—
ProductLinuxfoundation Everest
PublishedMar 26, 2026
First seenMar 26, 2026
Weakness typeCWE-863Incorrect authorization

How to fix

Update
  • linuxfoundation everest2026.02.0 or later

Affected products

ProductAffected versionsFixed in
linuxfoundation everestv < 2026.02.02026.02.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.