CVE-2026-3630

published 2026-03-09

CVE-2026-3630: Delta Electronics COMMGR2 has Stack-based Buffer Overflow vulnerability.

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Delta Electronics COMMGR2 has

Stack-based Buffer Overflow vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
deltaww	commgr2	< 2.11.1	2.11.1
deltaww	commgr2	<= 2.11.0	—

Detection & IOCs extracted from sources · hover to see the quote

• → A specially crafted message type 3 sent to Delta Electronics COMMGR version 2.11.0 can trigger a stack-based buffer overflow (CVE-2026-3630); monitor for unexpected or malformed network messages targeting COMMGR on the network. ↗
• → CVE-2026-3630 is network-exploitable with no authentication and no user interaction required (CVSS AV:N/AC:L/PR:N/UI:N), meaning exploitation can occur remotely without credentials; alert on unexpected connections to COMMGR service ports. ↗

• · Only COMMGR version 2.11.0 is confirmed vulnerable; upgrade to version 2.11.1 or later to remediate CVE-2026-3630. ↗
• · The fix is available in COMMGR version 2.11.1 or later; ensure OT/ICS environments running Delta Electronics COMMGR are patched. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787