CVE-2026-15688
Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
- State
- Published
- Severity
- 9.2 Critical
- Published
- Sep 17, 2026
- Updated
- Oct 9, 2026
- Reserved
- Jul 14, 2026
Description
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H | Mitsubishi |
Weaknesses
- CWE-303 Incorrect Implementation of Authentication Algorithm
Affected Products
| Product | Versions |
|---|---|
GX Works3Mitsubishi Electric Corporation |
|
Motion Control SettingMitsubishi Electric Corporation |
|
References
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdfvendor-advisory
- https://jvn.jp/vu/JVNVU99700314government-resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.