Mitsubishi Electric GX Works3 and Motion Control Settings Authentication Bypass Vulnerability

Mitsubishi Electric has issued a security advisory regarding a vulnerability affecting its GX Works3 engineering software and Motion Control Settings package. The vulnerability, tracked as CVE-2026-15688, involves an incorrect implementation of the authentication algorithm that could allow a local attacker to bypass block password protection.

According to the advisory, successful exploitation could permit a local attacker to authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory. This would allow the attacker to view, tamper with, destroy, or delete control programs.

The affected products are Mitsubishi Electric GX Works3 (all versions) and Mitsubishi Electric Motion Control Settings (Software packaged with GX Works3, all versions). The vulnerability has been assigned a CVSS base score of 8.8 (vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), with a critical severity score of 9.2 under CVSS version 4.0.

Mitsubishi Electric recommends that users of GX Works3 download version 1.096A or later, and users of Motion Control Settings download version 1.070Y or later. The vendor also advises setting the security version to "2" in project settings, referencing specific sections of the operating manuals for each product. Additionally, Mitsubishi Electric recommends restricting physical access, blocking remote logins from untrusted networks, and using firewalls or VPNs to prevent unauthorized access.