Is CVE-2026-44622 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44622 being exploited in the wild.

How severe is CVE-2026-44622?

Medium severity, with a CVSS score of 6.5, published 25 June 2026.

Which products and versions are affected?

EVoke Systems CSMS All versions.

Is there a fix for CVE-2026-44622?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44622 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44622?

Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44622: EVoke Systems EVoke CSMS credential exposure via mapping platforms

CVE-2026-44622 · Severity: medium · CVSS 6.5 · Published 2026-06-25

EVoke Systems Charging Station Management System (CSMS) is used to manage and monitor electric vehicle charging infrastructure. A vulnerability exists where authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure could allow unauthorized individuals to identify and potentially spoof charging stations, leading to unauthorized administrative control or disruption of charging services.

Technologies: EVoke Systems CSMS. Vendors: EVoke Systems.

Quick answers

Is CVE-2026-44622 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44622 being exploited in the wild.
How severe is CVE-2026-44622?: Medium severity, with a CVSS score of 6.5, published 25 June 2026.
Which products and versions are affected?: EVoke Systems CSMS All versions.
Is there a fix for CVE-2026-44622?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44622 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44622?: Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The EVoke Systems Charging Station Management System (CSMS) suffers from a credential exposure vulnerability (CWE-522) where charging station authentication identifiers are accessible via public web-based mapping platforms. This vulnerability stems from the system's support for legacy OCPP security profiles (0 and 1) in certain hardware, which lack robust authentication. An unauthenticated remote attacker can harvest these identifiers to impersonate legitimate charging stations. Successful exploitation can lead to unauthorized administrative actions or denial-of-service by disrupting legitimate station connections. The vendor is working to migrate devices to OCPP Security Profiles 2 or 3 and implementing server-side allow-listing to mitigate risks for legacy hardware.

Affected products

EVoke Systems EVoke CSMS All versions

Timeline

2026-06-25: disclosed
2026-06-25: advisory: CISA Advisory ICSA-26-176-02 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.