The vulnerability identified as CVE-2026-78314 affects Delta DIAEnergie v1.11.00.002 and is classified under CWE-89 (SQL Injection). It arises from improper neutralization of special elements used in SQL commands, enabling an attacker with low privileges to perform remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The vendor has not provided a remediation level or patch information, and the product is not a cloud service. No public exploit code or active exploitation has been reported.

Successful exploitation of this vulnerability can lead to remote code execution with high impact on system confidentiality, integrity, and availability. An attacker with limited privileges can leverage this SQL Injection flaw to execute arbitrary commands on the affected system, potentially compromising the entire environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable version to untrusted networks.