EVerest is an electric vehicle charging software stack that contains a data race in the handling of the MQTT command `everest_external/nodered/{connector}/cmd/switch_three_phases_while_charging`. The race allows simultaneous access to `Charger::shared_context` and `internal_context` without proper locking, resulting in undefined C++ behavior that can corrupt memory and disrupt the charger’s state. This weakness is a classic concurrent modification flaw (CWE‑362).

All installations of EVerest everest-core running a version earlier than 2026.02.0 are affected. The vulnerability is confined to the core stack developed by the Linux Foundation and does not extend to other vendors or product families.

The CVSS score of 8.2 indicates high severity, but the EPSS probability is below 1% and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is network-based and requires an attacker to have the ability to publish the specific MQTT command to the broker; therefore it is limited to entities with MQTT write access. Version 2026.02.0 contains a patch that removes the race and protects the shared context. Users still exposed to older versions are at risk and should upgrade promptly.