CVE-2026-0975 is a command injection flaw in Delta Electronics DIAView, the industrial HMI and SCADA software, in V4.2.0 and earlier. NVD scores it 7.8, high severity. Delta says the fix is DIAView V4.4 or later, and it lists no workaround for older builds.
What's affected
Delta Electronics' advisory, Delta-PCSA-2026-00002, published 16 January 2026, says:
- Product: DIAView.
- Affected versions: V4.2.0 and prior.
- Fixed version: V4.4 or later, from the Delta Download Center.
- Workaround: none. Delta marks the corrected flag as yes and the workaround flag as no.
- Severity: Delta rates it High at CVSS 7.8. The vector is
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which is a local attack that needs a user to take an action. - Exploitation: the advisory does not mention exploitation, and it is not on the CISA KEV list.
The advisory title calls the issue an exposed dangerous method leading to remote code execution. The CVE description is shorter, naming command injection.
How to check if you're exposed
Find DIAView installs first. They are usually on engineering workstations and operator stations rather than servers, so check your OT asset inventory before you check anything else.
On a Windows host, look for the product in installed programs, or ask the system integrator that deployed it. The version is shown in the application and in the installed program list. Anything at V4.2.0 or lower is in scope; Delta's list of affected versions says V4.2.0 and prior.
If you do not have a good inventory of operator stations, build one from the network. Control system hosts should appear in your asset discovery tool, and if you use the free scan at gold.safeguard.sh/scan on a software bill of materials from an integrator, you can match components against known issues.
The attack vector in the score is local with user interaction. That means the attacker needs to get a person on the station to do something, such as open a file. Ask whether those stations can open email, browse the web or take files from USB drives.
What to do now
- Download DIAView V4.4 or later from the Delta Download Center and plan the upgrade with your system integrator.
- Test the new version on a copy of the project before you install it on a production line, since HMI projects can behave differently across versions.
- Follow the general recommendations in the Delta advisory: do not click untrusted links or open unsolicited attachments, keep control systems off the internet, place them behind a firewall isolated from the business network, and use a VPN for remote access.
- Until you upgrade, limit who can log in to operator stations, and block removable media and email on them.
- Record the exposure in your OT risk register with the date of the planned upgrade.
Why it matters
The weakness is CWE-77, improper neutralization of special elements in a command. The advisory title says an exposed dangerous method allowed remote code execution. In plain terms, a function in the product could be reached in a way that let outside input become a system command.
Operational technology has long patch cycles. A plant cannot reboot a station on a Tuesday afternoon, and upgrades need testing. That makes the compensating controls in Delta's advice more than boilerplate: isolation, no internet exposure, and VPN-only remote access are what keep a high severity flaw from becoming an incident while the upgrade waits for a maintenance window.
The score is lower than many remote flaws because the vector says local and needs a user action. Do not read that as safe. Phishing and removable media are how many OT incidents begin, and once code runs on an HMI it sits close to the process.
Quick check
Is there a workaround for CVE-2026-0975?
Delta lists none. The corrected version is DIAView V4.4 or later, and Delta advises isolating control systems from the business network and the internet.
Why is the score 7.8 and not higher?
The vector is local and needs user interaction. It still rates confidentiality, integrity and availability impact as high.
Sources
Last reviewed: 19 October 2026.
