LiveThreat Vulnerability Brief — CVE‑2026‑3094 (Delta Electronics CNCSoft‑G2)
What It Is — Delta Electronics’ CNCSoft‑G2 industrial‑control software contains an out‑of‑bounds write flaw in the DOPSoft component when parsing DPAX files. Successful exploitation grants an attacker remote code execution on the affected controller. Exploitability — No public exploit or proof‑of‑concept has been released, but the vulnerability is rated CVSS v3 7.8 (High) and CISA flags it as actively exploitable in the wild.
Affected Products — Delta Electronics CNCSoft‑G2 (all versions prior to V2.1.0.39).
TPRM Impact — The flaw can be leveraged to compromise manufacturing execution systems, potentially halting production lines, leaking proprietary designs, or providing a foothold for downstream supply‑chain attacks. Organizations that rely on third‑party CNC equipment must treat this as a critical supply‑chain risk.
Recommended Actions —
- Verify firmware version on every CNCSoft‑G2 device; inventory any installations < V2.1.0.39.
- Immediately apply the vendor‑provided update to version 2.1.0.39 via the Delta Electronics download centre.
- Isolate affected controllers from external networks until patched; enforce strict network segmentation for OT assets.
- Review IDS/IPS signatures for anomalous DPAX file traffic and enable logging of DOPSoft component activity.
- Incorporate the CVE into third‑party risk assessments and contractual security clauses for manufacturing partners.
Source: CISA Advisory – ICSA‑26‑064‑01