CVE-2026-12818 describes a resource allocation vulnerability (CWE-770) in Delta Electronics DVP12SE PLCs affecting the Modbus TCP service. The flaw allows the device to allocate resources without limits or throttling, which can be exploited remotely over the network without authentication or user interaction. This can cause high impact on confidentiality, integrity, and availability as per the CVSS 4.0 vector. The vulnerability is publicly disclosed but lacks vendor-provided remediation or patch information. No affected versions are specified.

The vulnerability can lead to resource exhaustion on the affected PLC, potentially causing denial of service or degraded performance. Given the critical CVSS score and the lack of authentication required for exploitation, the impact on device availability and operational continuity is significant. Confidentiality and integrity impacts are also rated high in the CVSS vector, indicating potential broader consequences if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as limiting access to the Modbus TCP service to trusted hosts and monitoring for unusual traffic patterns targeting the PLC. Avoid exposing the device directly to untrusted networks.