CVE-2026-9158: Eclipse 4diac FORTE use-after-free via crafted DELETE connection command
Eclipse 4diac FORTE versions 3.0.0 through 3.1.0 contain a use-after-free flaw (CWE-416) in the handling of DELETE connection commands sent to the management interface. NVD rates it 9.8 (CVSS v3.1), while the Eclipse CNA scores it 5.2 under CVSS v4.0. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-9158 is a memory-safety flaw in Eclipse 4diac FORTE. According to the record, a specially crafted DELETE connection command sent to the management interface can leave a dangling pointer, so that later commands access memory that has already been freed. The weakness is classified as CWE-416 (Use After Free). Details are tracked in the Eclipse vendor advisory work item.
Impact
NVD assigns a CVSS v3.1 base score of 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The Eclipse CNA, however, rates it 5.2 under CVSS v4.0, so the two assessments differ considerably. Use-after-free conditions commonly cause crashes and, in some circumstances, may enable memory corruption beyond denial of service; the record does not specify which outcome is realistic here. Because 4diac FORTE is a runtime used in automation environments, a crash or corruption could affect controlled processes.
Affected products and versions
- Eclipse 4diac FORTE versions 3.0.0 through 3.1.0 (inclusive)
Exploitation status
The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Review the Eclipse advisory and upgrade to a release later than the affected range once the project confirms a fixed version; the record does not name one.
- Restrict network access to the FORTE management interface so that only trusted engineering hosts can reach it, using segmentation and firewall rules.
- Avoid exposing FORTE devices to untrusted networks or the internet.
- Monitor the vendor channel for patches and backports.
Detection guidance
- Inventory systems running 4diac FORTE and identify versions in the 3.0.0 to 3.1.0 range.
- Log and alert on management-interface connections from unexpected sources, especially those issuing connection deletion commands.
- Watch for unexpected FORTE process crashes or restarts, which may indicate attempts to trigger the flaw.
Limitations of the available information
The record lists no fixed version, no EPSS or SSVC data, and only one reference. The large gap between the NVD score (9.8) and the CNA score (5.2) is not explained, and the practical impact beyond memory access after free (for example, code execution) is not stated.
Frequently asked questions
Which versions of Eclipse 4diac FORTE are affected?
Versions 3.0.0 through 3.1.0, inclusive, according to the record.
Is CVE-2026-9158 being exploited in the wild?
It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Why are there two different severity scores?
NVD scored it 9.8 under CVSS v3.1, while the Eclipse CNA scored it 5.2 under CVSS v4.0. The record does not explain the difference.
Is there a fixed version?
The record does not name one. Check the Eclipse advisory and restrict access to the management interface in the meantime.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.