CVE-2026-44101 describes a missing authentication vulnerability in the CHARX OCPP Agent service. An unauthenticated remote attacker can exploit this flaw to reconfigure the backend connection of the service. The vulnerability can result in Denial-of-Service conditions, potentially disrupting EV charging infrastructure. Additionally, confidential data may be disclosed to the attacker through the misconfigured backend connection. The CHARX product is an EV charging controller that uses the OCPP (Open Charge Point Protocol) for backend communication. No authentication is required to trigger the vulnerability, making it easily exploitable remotely. The issue was reported via CERT@VDE advisory VDE-2026-008. This poses a significant risk to critical infrastructure, particularly EV charging networks.