The federal government’s industrial control team has flagged four flaws in monta.app, the platform electric vehicle charging operators use to run their networks. CISA published the advisory on October 1 and scored the group 9.4 out of 10, inside its critical band.
Where the weaknesses sit
The worst sits in the WebSocket endpoints that link chargers to Monta’s back end. They accept connections without authentication, so an attacker can pose as a charging station, reach sensitive data and issue privileged commands. CISA filed it as CVE-2026-95102 and rated it 9.3.
Three more complete the set. CVE-2026-97363, at 7.5, covers a WebSocket interface with no cap on authentication attempts, opening the way to brute-force logins and denial-of-service floods. CVE-2026-97212 describes session identifiers built from station IDs, which are predictable and reusable, letting one endpoint impersonate another. CVE-2026-93474 notes that station authentication identifiers are visible on public web mapping services.
Taken together, CISA says the bugs let an intruder take administrative control of exposed chargers or disrupt charging with denial-of-service attacks. The advisory lists the energy and transportation sectors and says the software runs worldwide.
Monta’s response is rolling rather than a single patch. The company says it is pushing authenticated connections across its network and retiring unauthenticated access, offers operators OCPP 1.6 Security Profile 2 with TLS, and has added rate limiting and automatic throttling at the WebSocket layer.
