Delta DIAEnergie EUVD-2026-85818

No special conditions - remote unauthenticated exploitation against DIAEnergie instances before version 1.11.00.022, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The only meaningful limiting factor is reachability: an attacker must have network access to the DIAEnergie service, and DIAEnergie is a niche ICS energy-management product typically deployed on operational/enterprise networks rather than broadly internet-exposed. No user interaction, authentication, or non-default configuration is required to trigger the authentication bypass.

This is a genuinely high-priority flaw by every static signal, tempered only by product footprint. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remotely reachable, low-complexity authentication bypass requiring no privileges or user interaction and yielding full compromise of confidentiality, integrity, and availability - the classic worst-case profile for an internet- or network-exposed application. The CWE-287 (Improper Authentication) classification is fully consistent with an auth-bypass leading to total system control. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is currently no evidence of active exploitation or automated weaponization; the danger here is potential, not yet observed. Note the disclosure is self-reported by the vendor (Deltaww) via advisory PCSA-2026-00014, which covers a batch (CVE-2026-78308 through 78313) - vendor-reported ICS advisories of this type are historically attractive targets and frequently draw follow-on CISA ICS advisories, so exploitation likelihood may rise once details/patch-diffing spread. The offsetting factor is deployment scale: DIAEnergie is niche industrial energy-management software, so raw 9.8 severity does not equate to broad, internet-wide exploitability. Bottom line: for any organization actually running DIAEnergie this is a patch-now issue; for the general population it is a narrow, sector-specific risk.

A remote attacker who can reach a DIAEnergie web/service endpoint sends a crafted request that bypasses the authentication mechanism, gaining privileged access without valid credentials. From there they can read sensitive energy-management data, alter configuration or records, and disrupt the service. No public exploit code was identified at time of analysis, but the low attack complexity and no-authentication requirement make weaponization straightforward once details circulate.