The U.S. Cybersecurity and Infrastructure Security Agency (CISA) published industrial control systems advisory ICSA-26-274-02 on October 1, 2026, covering four vulnerabilities in a cloud platform used to manage EV charging stations worldwide. The most severe, CVE-2026-95102, carries a CVSS v3 score of 9.4 and stems from WebSocket endpoints that lack proper authentication, letting attackers impersonate charging stations. All versions of the affected platform, Monta’s monta.app, are listed.
Key Takeaways
- CISA advisory ICSA-26-274-02 rates a charging-platform authentication flaw at 9.4.
- Unauthenticated WebSocket links let attackers pose as charging stations.
- Enabling OCPP security profiles with TLS is the main mitigation named.
- Operators should audit back-office authentication settings at every site.
Key Figures
| CVE | Weakness | CVSS v3 |
|---|---|---|
| CVE-2026-95102 | Missing authentication on WebSocket endpoints; station impersonation | 9.4 (Critical) |
| CVE-2026-97363 | No limit on authentication attempts; brute force or denial of service | 7.5 (High) |
| CVE-2026-97212 | Multiple connections allowed with the same session identifier | 7.3 (High) |
| CVE-2026-93474 | Station authentication identifiers visible on public mapping platforms | 6.5 (Medium) |
What CISA Reported
CISA says successful exploitation could give attackers unauthorized administrative control over vulnerable charging stations or disrupt charging through denial-of-service attacks. The advisory lists the energy and transportation sectors as affected, with worldwide deployment. No known public exploitation had been reported to CISA at the time of release.
For mitigation, the vendor states it supports OCPP 1.6 Security Profile 2, which adds HTTP Basic Authentication over TLS, encourages operators to enable it, and is deprecating unauthenticated connections on a rolling basis. It also reports rate limiting and automatic blocking of abusive connection patterns. CISA’s general advice is to minimize network exposure, place control systems behind firewalls and use secure remote access methods.
What It Means
The pattern behind this advisory, chargers connecting to a back office without authentication and with guessable identifiers, is a configuration risk that applies across the industry, not only to one platform. Charge point operators should confirm which OCPP security profile each site actually runs, and installers should not leave chargers on default or unauthenticated back-office settings after commissioning.
When buying hardware, ask the supplier which OCPP version and security profiles the firmware supports, and how firmware updates are delivered. EVDANCE’s networked EV-AC03201T dual-connector AC station runs OCPP 1.6J; site owners can review options with our commercial charging team.
Related Reading
- OCPP Explained: What Charge Point Operators Need From EV Charger Hardware
- Commercial EV Charger Maintenance Checklist
- How Do Commercial EV Charging Stations Work?
