Is CVE-2026-44383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44383 being exploited in the wild.

How severe is CVE-2026-44383?

High severity, with a CVSS score of 7.5, published 10 July 2026.

Which products and versions are affected?

Hydro-Québec Le Circuit Electrique charging station backend before June 2026.

Is there a fix for CVE-2026-44383?

A patch was published on 2026-06-01: Remediations implemented by Hydro-Québec in June 2026 update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44383 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44383?

Check whether you run Hydro-Québec Le Circuit Electrique charging station backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44383: Hydro-Québec Le Circuit Electrique denial of service in charging backend

CVE-2026-44383 · Severity: high · CVSS 7.5 · Published 2026-07-10

The Hydro-Québec Le Circuit Electrique charging station backend, which manages electric vehicle charging infrastructure, is vulnerable to a denial-of-service attack. An attacker can connect multiple malicious clients using the same charging station ID to overwhelm the system. This could lead to service outages, preventing legitimate users from using charging stations or disrupting the management of the charging network.

Technologies: Hydro-Québec Le Circuit Electrique charging station backend. Vendors: Hydro-Québec.

Quick answers

Is CVE-2026-44383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44383 being exploited in the wild.
How severe is CVE-2026-44383?: High severity, with a CVSS score of 7.5, published 10 July 2026.
Which products and versions are affected?: Hydro-Québec Le Circuit Electrique charging station backend before June 2026.
Is there a fix for CVE-2026-44383?: A patch was published on 2026-06-01: Remediations implemented by Hydro-Québec in June 2026 update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44383 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44383?: Check whether you run Hydro-Québec Le Circuit Electrique charging station backend at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Hydro-Québec Le Circuit Electrique charging station backend fails to properly restrict concurrent sessions using the same charging station identifier. This vulnerability, classified as Insufficient Session Expiration (CWE-613), allows a remote attacker to deploy multiple instances of malicious Open Charge Point Protocol (OCPP) clients using a single ID. By flooding the backend with these duplicate connections, an attacker can exhaust system resources and cause a denial-of-service (DoS) condition. The vulnerability is reachable over the network without authentication. Hydro-Québec has mitigated the risk by disabling OCPP on most stations and implementing new authentication systems for those still requiring it as of June 2026.

Affected products

Hydro-Québec Le Circuit Electrique charging station backend before June 2026

Timeline

2026-07-07: advisory: Initial publication by CISA (ICSA-26-188-01)
2026-07-10: disclosed: CVE-2026-44383 published to NVD
2026-06-01: patched: Remediations implemented by Hydro-Québec in June 2026 update

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.