The Cybersecurity and Infrastructure Security Agency has issued an industrial control systems advisory identifying a critical vulnerability in the Monta electric vehicle charging management platform, warning that exploitation of the flaw could allow an unauthenticated remote attacker to bypass authentication controls entirely. The advisory, designated ICSA-26-274-02, was published by CISA and places Monta’s web-based software in the category of systems requiring immediate operator attention. As electronic warfare gaps and civilian infrastructure vulnerabilities increasingly intersect in modern threat assessments, the disclosure underscores how commercial energy management software has become a target surface for adversaries seeking leverage over critical systems.

Monta operates a cloud-connected platform used by charge point operators, fleet managers, and facility administrators across multiple countries to manage EV charging infrastructure. The platform’s broad deployment in commercial and institutional settings means that a successful exploit would not be limited to a single facility — it could affect charging networks serving logistics fleets, government facilities, or semi-public infrastructure depending on operator configuration.

Vulnerability Scope and Technical Characterization

According to the CISA advisory, the vulnerability is classified under CWE-288, authentication bypass using an alternate path or channel. CISA assigned the flaw a CVSS v4 base score of 9.3, placing it firmly in the critical severity band. The agency notes that the vulnerability is exploitable remotely and requires no special privileges or user interaction to trigger, a combination that significantly lowers the bar for potential attackers operating at range.

CISA did not specify in the advisory whether active exploitation has been observed in the wild, and officials have not confirmed any confirmed incidents tied to this specific flaw at the time of publication. The agency’s standard guidance applies: organizations using the Monta platform should review the advisory details, apply any available mitigations, and minimize network exposure for affected systems. CISA further recommends that control system devices not be accessible from the public internet and that remote access, when necessary, be conducted through encrypted channels such as a VPN — though the agency notes that VPNs themselves carry risk if not kept current.

Infrastructure Implications and Operator Guidance

The significance of this advisory extends beyond a single software product. EV charging infrastructure has expanded rapidly across commercial, municipal, and federal environments, and the management platforms that sit above physical charge points represent a concentrated attack surface. An authentication bypass at the platform layer could, depending on system architecture, allow an attacker to manipulate charging sessions, extract operator or user data, or interfere with billing and access control functions that underpin commercial operations.

CISA directed affected organizations to the ICS advisory page for remediation details and encouraged operators to conduct impact assessments consistent with their specific deployment environments. Monta, a Denmark-based company operating the monta.app platform, had not issued a separate public statement visible through official channels at the time this article was prepared. CISA’s advisory process for ICS vulnerabilities typically coordinates with vendors prior to publication, though the agency does not always disclose the timeline of that coordination in the public advisory text. Operators running Monta’s platform in any capacity — whether for commercial charge point networks or internal fleet management — should treat this advisory as requiring prompt review given the critical CVSS score assigned.