CVE-2026-15688: Mitsubishi GX Works3 Auth Bypass Flaw

CVE-2026-15688 Overview

CVE-2026-15688 is an authentication bypass vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting engineering software. The flaw stems from an incorrect implementation of the block password authentication algorithm [CWE-303]. A local attacker who runs the affected product and modifies part of the executable module in memory can authenticate successfully with an invalid block password. Successful exploitation allows adversaries to view, tamper with, destroy, or delete control programs used to configure industrial control systems.

Critical Impact
Local attackers can bypass block password protection and gain full access to control program logic on affected Mitsubishi Electric engineering workstations, enabling manipulation of programmable logic controller (PLC) projects.

Affected Products

Mitsubishi Electric GX Works3
Mitsubishi Electric Motion Control Setting
Engineering workstations running the affected software

Discovery Timeline

2026-09-17 - CVE-2026-15688 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-15688

Vulnerability Analysis

The vulnerability resides in how GX Works3 and Motion Control Setting validate block passwords used to protect program blocks within engineering projects. The authentication routine is implemented in a way that permits an attacker running the application locally to modify the in-memory executable module and coerce the check into returning success regardless of the supplied password.

Block passwords are the primary mechanism engineers use to restrict read, write, and execution access to sensitive program blocks in Mitsubishi PLC projects. Bypassing them exposes proprietary control logic and safety interlocks. An attacker who succeeds can read, alter, or delete control programs that ultimately execute on production PLCs, undermining the integrity and availability of industrial processes.

Root Cause

The root cause is classified under [CWE-303] Incorrect Implementation of Authentication Algorithm. The password comparison and verification logic does not enforce a tamper-resistant control flow within the process. Because the check is performed inside the same address space the operator controls, memory patching of the affected instructions or return values is sufficient to defeat it.

Attack Vector

Exploitation requires local access to a workstation with the affected software installed and low-privileged authenticated access to run the application. No user interaction beyond the attacker is required. The attacker launches GX Works3 or Motion Control Setting, attaches to or manipulates the running process, and patches the authentication routine in memory before submitting an arbitrary block password.

The vulnerability does not permit remote exploitation over the network, but engineering workstations are frequently shared assets within operational technology (OT) environments and are attractive pivot points after an initial intrusion.

No verified exploit code is publicly available. See the Mitsubishi Electric Security Advisory and the JVN Vulnerability Report for vendor technical details.

Detection Methods for CVE-2026-15688

Indicators of Compromise

Unexpected process handle openings against GX Works3.exe or Motion Control Setting executables, especially with PROCESS_VM_WRITE or PROCESS_VM_OPERATION access rights.
Debuggers, memory editors, or DLL injection utilities loaded on engineering workstations that host the affected software.
Unauthorized modifications, exports, or deletions of protected program blocks in PLC project files.

Detection Strategies

Monitor for cross-process memory writes and code patching targeting the affected engineering applications.
Alert on execution of tools such as WriteProcessMemory callers, debuggers, or reverse-engineering utilities on operator workstations where they are not sanctioned.
Correlate engineering software launches with off-hours activity or logons from accounts that do not normally perform controller programming.

Monitoring Recommendations

Enable file integrity monitoring on Mitsubishi engineering software directories and on PLC project repositories.
Forward workstation process, module load, and authentication events to a centralized SIEM or data lake for correlation.
Track download or transfer operations from engineering workstations to PLCs, and compare project checksums before and after operator sessions.

How to Mitigate CVE-2026-15688

Immediate Actions Required

Restrict interactive and remote logon on engineering workstations to a small, audited set of engineering personnel.
Remove debugging, memory editing, and reverse-engineering tools from operator workstations, and enforce application allowlisting.
Do not rely on block passwords as the sole protection for sensitive control logic until the vendor patch is applied.

Patch Information

Refer to the Mitsubishi Electric Security Advisory 2026-007 for the current list of fixed versions and update procedures for GX Works3 and Motion Control Setting. Additional coordination details are available in the JVN Vulnerability Report.

Workarounds

Isolate engineering workstations on a dedicated OT management network segment, separated from IT and general-purpose systems.
Apply the principle of least privilege so that only authorized engineers can launch the affected software or access PLC project files.
Store PLC project files in access-controlled repositories with version history, and require multi-person review before deployment to production controllers.
Physically secure engineering workstations and enforce full-disk encryption plus screen locking to reduce opportunities for local tampering.

bash

# Example: enable Windows application allowlisting via AppLocker to block
# unauthorized memory-editing tools on engineering workstations.
New-AppLockerPolicy -RuleType Publisher,Hash,Path `
  -User "Everyone" -Optimize -XmlPolicy .\ot-workstation-allowlist.xml
Set-AppLockerPolicy -XmlPolicy .\ot-workstation-allowlist.xml -Merge