CVE-2026-3630

Critical

Published: 09 March 2026

Published

09 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0096 57.1th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-3630 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Deltaww Commgr2. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2026-3630 is a stack-based buffer overflow vulnerability (CWE-787) affecting Delta Electronics COMMGR2 software. Published on 2026-03-09, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Remote attackers require no authentication privileges and no user interaction to exploit the vulnerability over the network with low complexity. Successful exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially leading to full system compromise.

Delta Electronics has issued advisory Delta-PCSA-2026-00005, which addresses multiple vulnerabilities in COMMGR2, including CVE-2026-3630 and CVE-2026-3631. The advisory is available at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-10286

Vulnerability details

Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.

CWE(s): CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

Remote unauthenticated stack-based buffer overflow (CWE-787) in network-exposed COMMGR2 service enables arbitrary code execution and full system compromise; directly maps to initial access via public-facing application exploitation (T1190) and remote service exploitation (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0