Successful exploitation of this vulnerability, discovered by researchers Mayeul Fargier, Erwan Cordier, and Noé Flatreaud, could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.
Mitsubishi Electric GX Works3 is the latest generation programming, configuration, and maintenance software suite designed for MELSEC iQ-R and iQ-F series control systems.
- Mitsubishi Electric GX Works3, all versions
- Mitsubishi Electric Motion Control Settings, software packaged with GX Works3, all versions
In one issue, there is an incorrect implementation of authentication algorithm vulnerability in the affected products that allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory. That could allow the attacker to view, tamper with, destroy, or delete control programs.
CVE-2026-15688 is the case number for the vulnerability, which has a CVSS V3 base score of 8.8.
The product sees use mainly in the critical manufacturing sector, and on a global basis.
Mitigations
In terms of mitigations, for those using GX Works3, click here to download version 1.096A or later. Install it, and set the security version for projects to “2”. Refer to “15.9 Preventing Illegal Access to/Falsification of Data (Security Version)” in “GX Works3 Operating Manual” for details.
For more information about the workaround, click on the Mitsubishi security advisory.
For customers using Motion Control Settings (Software packaged with GX Works3), click here to download version 1.070Y or later.
Install it, and set the security version for projects to “2.” Refer to “12.5 Preventing Illegal Access to/Falsification of Data (Security Version)” in “Motion Control Setting Function Help” for details.
For more information about the workaround, click on the Mitsubishi Electric security advisory.
For customers of the affected products, Mitsubishi Electric recommends for users to:
- Use a computer with the affected product within a LAN and blocking remote logins from untrusted networks, hosts, and users, to minimize the risk of exploiting this vulnerability.
- Use a firewall, virtual private network (VPN), etc., to prevent unauthorized access, and allowing remote login only to trusted users when connecting a computer with the affected product to the Internet, to minimize the risk of exploiting this vulnerability.
- Prevent the user from clicking on web links contained in emails or other messages from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploiting this vulnerability.
- Install antivirus software on a computer running the affected product, to minimize the risk of exploiting this vulnerability.
- Restrict physical access to a computer on which the affected product ends up installed, as well as to computers and network devices that can communicate with it, to minimize the risk of exploiting this vulnerability.