CVE-2026-44098
Medium
Elevated severity or exploit probability.
CVSS base
8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS — probability of exploitation (30 days)
1.7%
75.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-78
Published 2026-07-30 · modified 2026-07-30
Description
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.