Mitsubishi Engineering Tools Expose Control Programs Through Local Password Bypass

A high-severity authentication flaw in Mitsubishi Electric’s GX Works3 engineering software can let a local attacker bypass block-password protection and gain access to industrial control programs.

Tracked as CVE-2026-15688, the vulnerability also affects Motion Control Settings, a software component distributed with GX Works3. An attacker who can run the affected application and modify its executable code in memory may authenticate with an invalid password.

Successful exploitation could expose control programs to unauthorized viewing, alteration, destruction, or deletion. The products are used worldwide in the Critical Manufacturing sector, making compromised engineering workstations a potential route to operational disruption.

Mitsubishi Electric’s advisory was initially released and republished by CISA on September 17, 2026.

Every Listed Version Is Considered Affected

The vulnerability applies to two Mitsubishi Electric products:

• GX Works3: vers:all/*
• Motion Control Settings packaged with GX Works3: vers:all/*

Both products have a status of “known affected.” Although the affected-version data encompasses all versions, Mitsubishi Electric provides specific upgraded releases and a project security configuration intended to address the risk.

GX Works3 is an engineering environment used to work with control projects. Motion Control Settings supplies related configuration capabilities within the GX Works3 software package. The weakness affects authentication protecting blocks inside those projects rather than a network protocol exposed directly by a controller.

That distinction shapes the attack model. This is not described as a remotely exploitable flaw against an Internet-facing industrial device. The attacker must first obtain local access sufficient to start the vulnerable software and tamper with its in-memory executable module.

Local does not mean harmless. Engineering workstations are privileged assets because they hold, modify, and transfer the logic controlling industrial processes.

Memory Modification Defeats Block-Password Validation

CVE-2026-15688 is classified as CWE-303, Incorrect Implementation of Authentication Algorithm. The vulnerable software does not reliably enforce the expected block-password authentication after an attacker alters part of the running executable code.

The attack sequence requires the adversary to:

1. Obtain local access to a computer running GX Works3 or Motion Control Settings.
2. Launch the affected product.
3. Modify a portion of its executable module in memory.
4. Submit an invalid block password.
5. Pass authentication despite the incorrect credential.

The resulting access can allow the attacker to view protected control programs or tamper with their contents. The advisory also identifies destruction and deletion of control programs as possible outcomes.

This technique requires more than possession of a project file. The attacker needs low-level access to the engineering computer and enough privileges to interfere with a running process. However, the published scoring treats those requirements as relatively accessible once a system has been breached.

No user interaction is required during exploitation. The attack complexity is also rated low.

The issue received a CVSS v3.1 score of 8.8, High, with the vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

That assessment assigns high potential impact to confidentiality, integrity, and availability, while indicating that exploitation crosses a security scope boundary.

Under CVSS v4.0, the vulnerability has a 9.2, Critical rating:

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H

The two scoring systems model the consequences differently, but both identify a serious risk to the protected engineering data and connected operational environment.

Updating Alone Is Not the Complete Fix

Mitsubishi Electric’s remediation instructions combine a software upgrade with a project-level security setting. Administrators should complete both steps for the relevant product.

For GX Works3, customers should:

1. Install version 1.096A or later from Mitsubishi Electric’s software download portal.
2. Set the project security version to “2.”
3. Follow section 15.9, “Preventing Illegal Access to/Falsification of Data (Security Version),” in the GX Works3 Operating Manual.

For Motion Control Settings, customers should:

1. Install version 1.070Y or later.
2. Set the project security version to “2.”
3. Follow section 12.5, “Preventing Illegal Access to/Falsification of Data (Security Version),” in Motion Control Setting Function Help.

The product-specific procedures are also documented in Mitsubishi Electric security advisory 2026-007.

Organizations should inventory both standalone GX Works3 installations and systems containing the bundled Motion Control Settings software. Checking only the visible GX Works3 version may leave the associated component or project security configuration unaddressed.

Changes should first undergo operational impact and risk analysis. In industrial environments, engineering-software updates and project setting changes may need controlled testing before deployment to production workstations.

Restricting Workstation Access Reduces the Attack Path

Because exploitation requires local execution and memory modification, access to the engineering computer is the primary security boundary.

Mitsubishi Electric recommends operating affected systems within a LAN and blocking remote logins from untrusted networks, hosts, and users. When an engineering workstation requires Internet connectivity or remote administration, access should pass through firewalls, VPNs, or comparable controls and remain limited to trusted personnel.

The vendor also recommends:

• Blocking or discouraging access to links delivered through untrusted messages.
• Preventing users from opening untrusted email attachments.
• Installing antivirus software on computers running the affected products.
• Restricting physical access to engineering workstations.
• Limiting access to network equipment and other computers that can communicate with those systems.

CISA advises organizations to avoid exposing industrial control devices directly to the Internet. Control networks and remote devices should sit behind firewalls and remain separated from business environments.

VPNs can provide a safer remote-access channel, but they do not eliminate endpoint risk. The VPN infrastructure and every connected workstation must also remain patched and appropriately protected.

Network segmentation is particularly relevant here. An attacker who compromises an ordinary corporate endpoint should not automatically gain a path to the workstation used to edit control logic.

Defenders Have No Published Exploitation Indicators

No malware hashes, process artifacts, memory signatures, or other indicators of compromise have been disclosed for CVE-2026-15688. There is also no reported information establishing that the vulnerability has been exploited in attacks.

Where relevant telemetry is available, defenders should investigate unauthorized interactive or remote logins to engineering workstations, unexpected execution of GX Works3 components, suspicious process-memory manipulation, and unexplained changes to control projects. Project modifications should be compared with approved engineering work and known-good backups.

The available advisory does not identify CVE-2026-15688 as an entry in CISA’s Known Exploited Vulnerabilities catalog. Consequently, no KEV addition date or federal remediation deadline is known. No information has been disclosed about recent Mitsubishi Electric vulnerabilities entering KEV in connection with this issue.

The vulnerability was reported to Mitsubishi Electric by Mayeul Fargier, Erwan Cordier, and Noé Flatreaud. CISA’s publication is a direct republication of the vendor’s CSAF advisory for broader visibility.

For asset owners, the immediate priorities are clear: upgrade to the specified releases, set project security to version “2,” restrict access to engineering workstations, and verify that protected control programs have not been changed without authorization.