How to Fix CVE-2026-27028: mobility46.se (Bundle Sibling)

By Sai Kiran Pandrala. Last verified: 2026-05-25.

CVE-2026-27028 is a sibling vulnerability in the same vendor advisory as CVE-2026-22878. Apply the same patched build and you close both. The technical detail below is what differs.

What's different about CVE-2026-27028?

WebSocket endpoints lack proper authentication mechanisms, enabling

attackers to perform unauthorized station impersonation and manipulate

data sent to the backend. An unauthenticated attacker can connect to the

OCPP WebSocket endpoint using a known or discovered charging station

identifier, then issue or receive OCPP commands as a legitimate charger.

Given that no authentication is required, this can lead to privilege

escalation, unauthorized control of charging infrastructure, and

corruption of charging network data reported to the backend.

How to fix CVE-2026-27028

Apply the patched build per the primary write-up: How to Fix CVE-2026-22878. All commands, verification steps, and rollback notes for mobility46.se are listed there.

Frequently asked questions

Does the CVE-2026-22878 patch close CVE-2026-27028?

Yes. Both CVEs are addressed by the same vendor patch. Applying the patched build closes the full bundle.

Is CVE-2026-27028 listed in CISA KEV?

No public KEV listing at the time of this writing.

Where is the official advisory?

See https://www.mobility46.se/en/contact-us

References

• Official vendor advisory: https://www.mobility46.se/en/contact-us
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-27028
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Primary: How to Fix CVE-2026-22878

*Written by Sai Kiran Pandrala. Part of the mobility46.se bundle. Full procedure at how-to-fix-cve-2026-22878.*