High severity · published Jun 19, 2026
CVE-2026-8805
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series EtherNet/IP module
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP · Mitsubishi Electric Corporation
versions 1.000 and prior · source: vendor
In the news
VulnerabilityHigh
Mitsubishi Electric MELSEC iQ-F Series
View CSAF
Summary
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
The following versions of Mitsubishi Electric MELSEC iQ-F Series are affected:
MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP <=1.000 (CVE-2026-8805)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.5
Mitsubishi Electric
Mitsubishi Electric MELSEC iQ-F Series
Integer Overflow or Wraparound
Background
Critical Infrastructure Sectors: Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Japan
Vulnerabilities
Expand All +
CVE-2026-8805
An integer overflow or wraparound vulnerability exists in the EtherNet/IP function of MELSEC iQ-F Series EtherNet/IP module. This vulnerability could allow a remote attacker to cause a denial-of-service condition in the affected product by rapidly establishing a large number of TCP connections to it, resulting in an inconsistency in the product's internal connection management process and triggering improper memory access.
View CVE Details
Affected Products
Mitsubishi Electric MELSEC iQ-F Series
Vendor: Mitsubishi Electric
Product Version: Mitsubish...
Jun 18, 2026·CISA Advisories
Affected product
ME
Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP
Mitsubishi Electric Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8805
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8805
jvn.jp
https://jvn.jp/vu/JVNVU97140216/
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-05
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-002_en.pdf
