CISA Advisory: Mitsubishi Electric GX Works3 Authentication Bypass Vulnerability (CVE-2026-15688)

Vulnerability Overview Vulnerability Name: Mitsubishi Electric GX Works3 and Motion Control Setting Publication Date: September 17, 2026 Alert Code: ICSA-26-260-02 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems CVSS Score: v3 8.8 Vendor: Mitsubishi Electric Products: Mitsubishi Electric GX Works3 and Motion Control Setting Vulnerability Type: Improperly Implemented Authentication Algorithm Scope of Impact Critical Infrastructure Sector: Critical Manufacturing Deployment Countries/Regions: Global Company Headquarters Location: Japan Affected Versions: - Mitsubishi Electric GX Works3 vers:all/ (CVE-2026-15688) - Mitsubishi Electric Motion Control Setting (Software packaged with GX Works3) vers:all/ (CVE-2026-15688) Mitigation Strategies Recommended Practices: - Minimize the network exposure of all control system devices and/or systems, and ensure they are not accessible via the Internet. - Place control system networks and remote devices behind firewalls and isolate them from business networks. - When remote access is required, use more secure remote access methods, such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities, so they should be updated to the latest version. - Conduct appropriate impact analysis and risk assessment before deploying countermeasures. - Implement recommended cybersecurity strategies to proactively defend ICS assets. - Organizations should follow internal procedures and report findings to CISA for tracking and relevance analysis. Additional Information Background: - Successful exploitation of this vulnerability may allow a local attacker to authenticate successfully even using invalid block ciphers by executing the affected product and modifying a portion of the executable module in memory, thereby allowing the attacker to view, tamper with, destroy, or delete control programs. Acknowledgments: - Mayeul Fargier, Erwan Cordier, and Noé Flatreaud reported this vulnerability to Mitsubishi Electric. Legal Notice and Terms of Use: - This product is subject to this notification and the Privacy and Usage Policy. Translation Disclaimer: - This ICSA is a verbatim copy of a Common Safety Alert Framework (CSAF) alert, which is a direct translation of Mitsubishi Electric 2026-007. This republication is intended to increase visibility and is provided "as is" for informational purposes only. CISA assumes no responsibility for the editing or technical accuracy of any information in the republished alert and provides no warranties for any commercial products or services. For any questions regarding this alert, please contact Mitsubishi Electric directly. Revision History: - Initial Publication Date: 2026-09-17 - 2026-09-17: Initial release - 2026-09-17: Initial CISA republication of Mitsubishi Electric 2026-007 alert Tags Industry: Critical Manufacturing Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Alerts Satel Netco Design Grid Protection Alliance openPDC and openHistorian Red Lion Controls N-Tron 700 Series Hitachi Energy SOI Feedback Share your thoughts: We recently updated our anonymous product survey and welcome your feedback. Related Links Back to Top Topics Highlights Resources & Tools News & Events Careers About Footer CISA Central 1-844-Say-CISA contact@cisa.dhs.gov CISA.gov Official Website of the U.S. Department of Homeland Security About CISA Budget & Performance DHS.gov FOIA Requests No FEAR Act Office of Inspector General Privacy Policy Subscribe The White House USA.gov Website Feedback

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory: Mitsubishi Electric GX Works3 Authentication Bypass Vulnerability (CVE-2026-15688)

More from this source