by Kastro
Paper/Archive/CVE-2026-15688

CVE-2026-15688

Mitsubishi Electric Corporation GX Works3 — Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

EPSS 0.2%CVSS 9.2
critical.is priorityof 100
29
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 7.5.075 × 201.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.

Affected

ProductAffectedFixed inSource
GX Works3All versions–CNA
Motion Control SettingAll versions–CNA

Scores by source

Mitsubishi (CNA)9.2CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdfrefjvn.jp/vu/JVNVU99700314refcisa.gov/news-events/ics-advisories/icsa-26-260-02