CVE-2026-8986: Autel Maxicharger Single Charger Firmware

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station.

Affected products

• Autel Maxicharger Single Charger Firmware: up to and including 1.03.51

Published 2026-07-21. Last modified 2026-08-13.