What is the CVSS score of CVE-2026-9642?

CVE-2026-9642 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Delta Electronics DIAView are affected by CVE-2026-9642?

Delta Electronics DIAView contains a critical vulnerability enabling unauthenticated remote access to configured project databases (CVE-2026-9642, CVSS 9.8), creating complete data exposure risk…

How to fix or mitigate CVE-2026-9642?

Within 24 hours: Identify all Delta Electronics DIAView installations in production and staging environments; assess which instances have network exposure and protect sensitive databases. Within 7 days: Implement network segmentation to restrict DIAView access to trusted networks only; enforce database-level authentication independent of DIAView; disable remote access if operationally feasible. Within 30 days: Contact Delta Electronics with formal patch inquiry; evaluate system retirement or replacement options if remediation timeline exceeds risk tolerance; complete access audit of all affected databases.

Delta Electronics DIAView CVE-2026-9642

EUVD-2026-31970 CRITICAL

Use of Hard-coded Cryptographic Key (CWE-321)

2026-05-26 tenable

GHSA-4v2g-76qr-8gvj

Authentication Bypass Diaview

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 21:02 vuln.today

DescriptionCVE.org

There is a mitigation bypass / (incomplete fix) for CVE-2025-62582 (Unauthenticated Remote Database Access)

An unauthenticated remote attacker can access configured databases in a DIAView project.

AnalysisAI

Unauthenticated remote database access in Delta Electronics DIAView allows network-based attackers to reach configured project databases without credentials, bypassing the prior mitigation issued for CVE-2025-62582. The flaw carries a CVSS 9.8 rating with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis, but the original CVE it incompletely patches has known prior research from Tenable.

Technical ContextAI

DIAView is Delta Electronics' SCADA/HMI platform used in industrial automation environments to visualize and manage process data, with backing databases storing project configuration and historical telemetry. CWE-321 (Use of Hard-coded Cryptographic Key) indicates the root cause involves static or embedded cryptographic material that an attacker can derive or reuse to authenticate to the database tier, mirroring the original CVE-2025-62582 weakness. Because the fix for that earlier issue is incomplete, the same trust boundary between unauthenticated network clients and the project database can still be crossed using a variant technique against the affected CPE cpe:2.3:a:delta_electronics:diaview.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied intelligence; defenders should monitor Delta Electronics' DIAView download portal and any forthcoming ICS-CERT advisory referenced from the Tenable write-up at https://www.tenable.com/security/research/tra-2026-44 and apply the next DIAView release that explicitly cites CVE-2026-9642 as fixed. Until a verified update ships, restrict network reachability to the DIAView database service from non-engineering subnets using host or perimeter firewall rules, place the system behind a jump host with MFA, and disable any DIAView project that does not need external clients connecting to the configured database - these controls add operational friction for legitimate remote engineering access and may break integrations that rely on direct database connectivity, so coordinate with control-system owners before enforcing.