Mitsubishi Electric MELSEC ICS DoS Vulnerability CVE-2026-8806 Advisory

Vulnerability Overview A vulnerability exists in the MELSEC iQ-F Series FX5-ENET/IP Ethernet module manufactured by Mitsubishi Electric Co. An attacker can cause a denial of service (DoS) condition by continuously sending a large volume of communication packets to the product's Ethernet port. This increases the processing load on the product, prevents internal anomaly detection processing, and results in the cessation of communication functionality. Affected Scope Affected Versions: Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP vers:all/ (CVE-2026-8806) CVSS Score: v3 7.5 Vendor: Mitsubishi Electric Device: Mitsubishi Electric Co.'s MELSEC iQ-F Series FX5-ENET/IP Ethernet Module Vulnerability Type: Expected Behavior Violation Critical Infrastructure Sector: Critical Manufacturing Deployment Countries/Regions: Worldwide Company Headquarters Location: Japan Remediation CISA recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities: 1. Minimize Network Exposure: Ensure that all control system devices and/or systems are not accessible from the Internet. 2. Isolate Networks: Place control system networks and remote devices behind firewalls and isolate them from business networks. 3. Use Secure Methods: When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and ensure that the VPN is updated to the latest version. 4. Conduct Impact Analysis and Risk Assessment: Prior to deploying defensive measures, organizations should conduct appropriate impact analyses and risk assessments. 5. Implement Recommended Security Policies: Organizations should implement recommended cybersecurity policies to proactively defend ICS assets. 6. Report Suspicious Activity: Organizations should follow internal procedures and report suspicious malicious activity to CISA to facilitate tracking and correlation with other events. Additional Information Release Date: June 18, 2026 Alert Code: ICSA-26-169-06 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Disclaimer This ICS Alert is a direct republishing of Mitsubishi Electric 2026-003, intended to increase visibility and is provided “as is” for informational purposes only. CISA assumes no responsibility for edits or technical accuracy of republished alerts and makes no express or implied warranties regarding the information contained herein. Furthermore, CISA does not endorse any commercial products or services. For any questions regarding this alert, please contact Mitsubishi Electric directly. Revision History Initial Release Date: 2026-06-18 Revision 1: 2026-06-18, Initial Release Revision 2: 2026-06-18, Initial CISA Republish of Mitsubishi Electric 2026-003 Alert Tags Sector: Critical Manufacturing Sector Topic: Industrial Control System Vulnerabilities, Industrial Control Systems Related Alerts AzeoTech DAQFactory AVer PTC cameras Schneider Electric Easergy, EcoStruxure, PowerLogic, and Saitel Products Schneider Electric EasyLogic T150 and Saitel DP Contact Information CISA Central: 1-844-Say-CISA Email: contact@cisa.dhs.gov Footer CISA.gov: The official website of the U.S. Department of Homeland Security Related Links: About CISA, Budget and Performance, DHS.gov, FOIA Requests, No FEAR Act, Office of Inspector General, Privacy Policy, Subscribe, The White House, USA.gov, Website Feedback --- Note**: No Proof of Concept (POC) code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Mitsubishi Electric MELSEC ICS DoS Vulnerability CVE-2026-8806 Advisory