Critical Remote Code Execution in Delta Electronics CNCSoft‑G2 (CVE‑2026‑3094) Threatens Manufacturing Control Systems
What It Is – A newly disclosed out‑of‑bounds write flaw in the DPAX file parser of Delta Electronics’ CNCSoft‑G2 allows remote attackers to execute arbitrary code. The vulnerability is tracked as CVE‑2026‑3094 and carries a CVSS 7.8 (High) score.
Exploitability – Exploitation requires a victim to open a malicious DPAX file or visit a crafted web page that triggers the parser. No public exploit code has been released, but the vendor has confirmed the vulnerability is actively exploitable and has issued a patch.
Affected Products – Delta Electronics – CNCSoft‑G2 (industrial CNC control software).
TPRM Impact – The flaw resides in software that often sits inside a third‑party supply‑chain for manufacturers. A successful exploit could compromise production lines, cause downtime, and provide a foothold for further attacks on downstream partners.
Recommended Actions –
- Deploy Delta Electronics’ security update for CNCSoft‑G2 immediately.
- Inventory all CNCSoft‑G2 installations across your supplier base and verify patch status.
- Enforce strict file‑type controls; block DPAX files from untrusted sources.
- Conduct a risk assessment of any downstream processes that rely on the affected CNC systems.
- Monitor for anomalous process behavior or unexpected network connections from CNC workstations.