Critical severity · published Sep 17, 2026
CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
9.2
CVSS
0.2%
EPSS
No
On KEV
Description
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GW
GX Works3 · Mitsubishi Electric Corporation
All versions · source: vendor
MC
Motion Control Setting · Mitsubishi Electric Corporation
All versions · source: vendor
In the news
VulnerabilityHigh
Mitsubishi Electric GX Works3 and Motion Control Settings
View CSAF
Summary
Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.
The following versions of Mitsubishi Electric GX Works3 and Motion Control Settings are affected:
Mitsubishi Electric GX Works3 vers:all/* (CVE-2026-15688)
Mitsubishi Electric Motion Control Settings (Software packaged with GX Works3) vers:all/* (CVE-2026-15688)
CVSS
Vendor
Equipment
Vulnerabilities
v3 8.8
Mitsubishi Electric
Mitsubishi Electric GX Works3 and Motion Control Settings
Incorrect Implementation of Authentication Algorithm
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Japan
Vulnerabilities
Expand All +
CVE-2026-15688
Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in the affected products allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.
View CVE Details
Affected Products
Mitsubishi Electric GX Works3 and...
Sep 17, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15688
vendor-advisory
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdf
government-resource
https://jvn.jp/vu/JVNVU99700314
government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02
