What is the CVSS score of CVE-2026-12576?

CVE-2026-12576 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Delta DVP80ES3 are affected by CVE-2026-12576?

Delta Electronics DVP80ES3 programmable logic controllers are vulnerable to unauthenticated, network-based denial of service attacks that can disrupt critical industrial operations.

How to fix or mitigate CVE-2026-12576?

Within 24 hours: Inventory all DVP80ES3 devices across the organization and document network locations and criticality. Within 7 days: Implement network segmentation or firewall access control lists to restrict DVP80ES3 communication to authorized networks and systems only; disable remote access if not operationally required. Within 30 days: Establish direct vendor contact with Delta Electronics to obtain patch release timeline; evaluate alternate PLC models for future procurement; develop operational contingency plans for affected production lines.

Delta DVP80ES3 CVE-2026-12576

EUVD-2026-40931 HIGH

Improper Enforcement of Message Integrity During Transmission (CWE-924)

2026-07-01 Deltaww

GHSA-55jc-fj8g-2w6j

Information Disclosure Dvp80Es3 Deltaww

7.5

CVSS 3.1 · Vendor: Deltaww

Severity by source

Vendor (Deltaww) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable channel with no integrity enforcement needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); confirmed impact per vendor is availability loss (A:H), with C/I set N absent evidence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Deltaww).

CVSS VectorVendor: Deltaww

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 08:33 vuln.today

DescriptionCVE.org

DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.

AnalysisAI

Denial of service in Delta Electronics DVP80ES3 programmable logic controllers arises from a failure to enforce message integrity on a communication channel (CWE-924), allowing remote, unauthenticated attackers to inject or tamper with protocol messages and disrupt device availability. Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H), the confirmed impact is loss of availability of this industrial controller with no privileges or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network-reachable, no-auth profile of an ICS device makes it operationally significant.

Technical ContextAI

The DVP80ES3 is part of Delta Electronics' DVP-ES3 line of compact programmable logic controllers (PLCs) used to automate machinery and processes on plant floors, identified by CPE cpe:2.3:a:deltaww:dvp80es3. The root cause is CWE-924, Improper Enforcement of Message Integrity During Transmission in a Communication Channel, meaning the device's network protocol does not adequately authenticate or integrity-check messages it receives (e.g., no cryptographic MAC or session validation). Industrial protocols spoken by such PLCs (Modbus/TCP and vendor-specific engineering protocols) historically lack built-in integrity protection, so a peer on the same network can forge, replay, or alter frames that the controller then acts on, here manifesting as an availability impact against the controller.

RemediationAI

No specific fixed firmware version is provided in the available data, so consult Delta advisory Delta-PCSA-2026-00009 (https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00009_DVP80ES3%20Multiple%20Vulnerabilities_v1%20(CVE-2026-12575,%2012576,%2012577).pdf) for the patched release and apply it; treat patch status as 'Patch available per vendor advisory' pending confirmation of an exact version. Because this is an OT device, compensating controls are essential: place the PLC behind an ICS-aware firewall and enforce strict network segmentation so only the engineering workstation and required HMIs can reach it (trade-off: requires accurate asset/flow mapping and may disrupt undocumented connections); restrict or filter the affected control/engineering protocol ports (e.g., Modbus/TCP 502 and Delta engineering ports) to an allowlist of trusted hosts (trade-off: can break legitimate polling if not scoped correctly); and deploy protocol-aware IDS monitoring for anomalous or malformed messages to that controller. Do not expose the PLC to the internet or to general corporate IT networks.