Is CVE-2026-50176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50176 being exploited in the wild.

How severe is CVE-2026-50176?

High severity, with a CVSS score of 7.5, published 25 June 2026.

Which products and versions are affected?

EVoke Systems CSMS All versions.

Is there a fix for CVE-2026-50176?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50176 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-50176?

Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50176: EVoke Systems EVoke CSMS improper rate limiting in WebSocket API

CVE-2026-50176 · Severity: high · CVSS 7.5 · Published 2026-06-25

EVoke Systems Charging Station Management System (CSMS), a platform used to manage electric vehicle charging infrastructure, is vulnerable to attacks that could disrupt service. Because the system does not limit the number of login attempts, an attacker could overwhelm the service or attempt to guess credentials. This could lead to a denial-of-service, preventing drivers from using charging stations, or potentially allow unauthorized access to the management platform.

Technologies: EVoke Systems CSMS. Vendors: EVoke Systems.

Quick answers

Is CVE-2026-50176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50176 being exploited in the wild.
How severe is CVE-2026-50176?: High severity, with a CVSS score of 7.5, published 25 June 2026.
Which products and versions are affected?: EVoke Systems CSMS All versions.
Is there a fix for CVE-2026-50176?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50176 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-50176?: Check whether you run EVoke Systems CSMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WebSocket API in EVoke CSMS fails to implement proper rate limiting or restrictions on the frequency of authentication requests (CWE-307). This vulnerability allows a remote, unauthenticated attacker to perform high-frequency connection attempts. Exploitation can result in a denial-of-service (DoS) condition by exhausting system resources or facilitate brute-force attacks to bypass authentication. The vendor is addressing this by implementing connection rate limiting at the WebSocket gateway layer and migrating legacy devices to more secure OCPP profiles (Security Profile 2 or 3).

Affected products

EVoke Systems EVoke CSMS (Charging Station Management System) All versions

Timeline

2026-06-25: disclosed
2026-06-25: advisory: CISA ICSA-26-176-02 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.