Is CVE-2026-3094 actively exploited?

No active exploitation of CVE-2026-3094 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-3094 be exploited remotely?

No. CVE-2026-3094 requires local access to exploit.

What is the CVSS score of CVE-2026-3094?

CVE-2026-3094 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-3094

HIGH

CVE-2026-3094

CWE-787Published: March 4, 2026· Updated: Mar 6, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.9th

Official Description

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

NVD Source

Technical Analysis

CVE-2026-3094 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.None

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors & Products

deltaww1 product

cncsoft-g2

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00004_CNCSoft-G2_File%20Parsing%20Out-Of-Bounds%20Write.pdf

News & Research Mentioning CVE-2026-3094

Delta Electronics CNCSoft-G2

CISA Alerts· Mar 5, 2026

View CSAF Summary Successful exploitation of this vulnerability could result in an attacker achieving remote code execution on the device. The following versions of Delta Electronics CNCSoft-G2 are affected: CNCSoft-G2 CVSS Vendor Equipment Vulnerabilities v3 7.8 Delta Electronics Delta Electronics CNCSoft-G2 Out-of-bounds Write Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: Taiwan Vulnerabilities Expand All + CVE-2026-3094 Delta Electronics CNCSoft-G2 devices prior to version V2.1.0.39 are vulnerable to an Out-of-Bounds Write while parsing DPAX files in the DOPSoft component. View CVE Details Affected Products Delta Electronics CNCSoft-G2 Vendor: Delta Electronics [xlite_meta score:79 src:CISA Alerts xlite_fp:f0af6f9fdb46705da8099687baa5ab0ce22cd5686e9374eac1c611511d0b809f]