CVE-2026-3630

Critical

Published: 09 March 2026

Published

09 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3630 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Deltaww Commgr2. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

preventrecover

Directly remediates the stack-based buffer overflow by applying vendor patches from Delta advisory Delta-PCSA-2026-00005.

SI-16 Memory Protection good match

preventdetect

Provides memory protections like stack canaries, ASLR, and DEP to prevent exploitation or detect stack buffer overflows.

SI-10 Information Input Validation good match

prevent

Enforces input validation and bounds checking on network inputs to COMMGR2 to avert stack-based buffer overflows from malformed data.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

Remote unauthenticated stack-based buffer overflow (CWE-787) in network-exposed COMMGR2 service enables arbitrary code execution and full system compromise; directly maps to initial access via public-facing application exploitation (T1190) and remote service exploitation (T1210).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.

Deeper analysisAI

CVE-2026-3630 is a stack-based buffer overflow vulnerability (CWE-787) affecting Delta Electronics COMMGR2 software. Published on 2026-03-09, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

Remote attackers require no authentication privileges and no user interaction to exploit the vulnerability over the network with low complexity. Successful exploitation enables high-impact consequences, including unauthorized disclosure of information, modification of data, and denial of service, potentially leading to full system compromise.

Delta Electronics has issued advisory Delta-PCSA-2026-00005, which addresses multiple vulnerabilities in COMMGR2, including CVE-2026-3630 and CVE-2026-3631. The advisory is available at https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00005_COMMGR%202%20Multiple%20Vulnerabilities%20(CVE-2026-3630,%20CVE-2026-3631).pdf.