# CVE-2026-12818: Delta Electronics DVP12SE resource exhaustion in Modbus TCP service

Source: https://junglewise.ai/threats/cve-2026-12818-delta-electronics-dvp12se-resource-exhaustion-in-modbus-tcp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-12818 · Severity: info · CVSS 9.3 · Published 2026-06-30

Delta Electronics DVP12SE programmable logic controllers (PLCs), which are used to automate industrial machinery and processes, contain a vulnerability in how they manage network connections. An attacker could exploit this to overwhelm the device's resources, potentially causing the controller to crash or become unresponsive. This could lead to a complete shutdown of industrial operations or loss of control over connected equipment.

Vendors: [Delta Electronics](https://junglewise.ai/threats/vendors/delta-electronics).

## Quick answers

**Is CVE-2026-12818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12818 being exploited in the wild.

**How severe is CVE-2026-12818?** Informational severity, with a CVSS score of 9.3, published 30 June 2026.

**Which products and versions are affected?** Delta Electronics DVP12SE All versions.

**Is there a fix for CVE-2026-12818?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12818 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-12818?** Check whether you run Delta Electronics DVP12SE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource allocation vulnerability (CWE-770) exists in the Modbus TCP service of Delta Electronics DVP12SE PLCs. The service fails to implement proper limits or throttling on incoming requests or connection resources. A remote, unauthenticated attacker can exploit this by sending a high volume of Modbus TCP traffic to exhaust device resources. Successful exploitation can lead to a denial-of-service (DoS) condition, impacting the availability and integrity of the industrial control process. The vulnerability is rated critical due to the lack of authentication required and the potential for total system impact.

## Affected products

- Delta Electronics DVP12SE PLC All versions

## Timeline

- 2026-06-30: advisory: Initial advisory published by Delta Electronics and NVD.

## References

- [https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf](https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00011_DVP12SE%20Multiple%20Vulnerabilities%20(CVE-2026-12818,%20CVE-2026-12819)_v1.0.pdf)