Delta Electronics DIAView version 4.4 contains a hard-coded cryptographic key vulnerability (CWE-321) identified as CVE-2026-9642. This flaw enables an unauthenticated remote attacker to bypass mitigations or incomplete fixes applied for CVE-2025-62582, which allowed unauthorized remote database access. The vulnerability is remotely exploitable without any user interaction or privileges and can lead to complete compromise of the confidentiality, integrity, and availability of the DIAView project databases.

An unauthenticated remote attacker can exploit this vulnerability to access configured databases within a DIAView project, potentially leading to full compromise of sensitive data and system functions. The CVSS score of 9.8 reflects critical impact across confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor. Users should monitor Delta Electronics advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restrict network access to DIAView instances and consider additional compensating controls to protect database access.