As reported by CISA in advisory ICSA-26-260-02, Mitsubishi Electric has disclosed a significant authentication vulnerability in its GX Works3 engineering software and bundled Motion Control Settings package. The flaw, tracked as CVE-2026-15688, carries a CVSS v3 score of 8.8 and affects all versions of both products — a remarkably broad exposure surface for a tool used to program and configure Mitsubishi PLCs deployed across critical manufacturing environments worldwide.
Vulnerability at a Glance
| CVE | CVE-2026-15688 |
| CVSS v3 | 8.8 (High) |
| CWE | CWE-303: Incorrect Implementation of Authentication Algorithm |
| Affected Products | GX Works3 (all versions), Motion Control Settings (all versions, bundled with GX Works3) |
| Vendor | Mitsubishi Electric |
| Patch Available | Yes — GX Works3 v1.096A or later + security version setting "2" |
| Active Exploitation | Not confirmed in the wild at time of advisory |
Why This Matters More Than a Typical Software Bug
This is not a standard IT application vulnerability. GX Works3 is the engineering environment used to develop, upload, and maintain ladder logic and motion control programs for Mitsubishi MELSEC iQ-R and iQ-F series PLCs. When an attacker can bypass block password authentication and manipulate the executable module in memory, they gain the ability to alter the control logic itself — the instructions that govern physical manufacturing processes, robotic motion, and safety interlocks.
The attack vector is local, which tempers the immediate blast radius. But in OT environments, engineering workstations are frequently shared across shifts, connected to multiple controllers, and may have inconsistent endpoint hardening. A single compromised or insider-accessible engineering machine becomes a pivot point for tampering with every PLC it touches.
The CWE-303 classification — incorrect implementation of an authentication algorithm — suggests the block password mechanism was fundamentally flawed in its implementation rather than suffering from a simple logic error. This means the protection customers believed they had on sensitive program blocks was effectively illusory across every version ever shipped.
Who Is Most Exposed
Shield53 Recommendations
Immediate Actions
- Patch now: Download and install GX Works3 version 1.096A or later from the Mitsubishi Electric FA software portal.
- Enable security version 2: After patching, set the security version for all projects to "2" as described in section 15.9 of the GX Works3 Operating Manual. The patch alone is insufficient without this configuration change.
- Audit engineering workstations: Inventory all machines running GX Works3, including service laptops and integrator systems. Any unpatched instance remains vulnerable.
- Review PLC program integrity: Compare current block logic against known-good backups for critical controllers. Look for unexpected modifications, especially in safety-related or proprietary blocks.
- Restrict local access: Enforce least-privilege OS accounts on engineering machines, disable unnecessary local accounts, and implement session lockout policies.
Broader Hardening
- Treat engineering workstations as Zone 1 assets within your ICS network segmentation strategy per IEC 62443. They should never reside on flat corporate networks.
- Implement application allowlisting on engineering stations to detect unauthorized process injection or memory manipulation tools.
- Deploy file integrity monitoring on project files and exported logic to catch tampering attempts between patching cycles.
- Reassess whether block passwords alone are sufficient IP protection — consider hardware security modules, encrypted project files, and controller-level authentication mechanisms as defense-in-depth layers.
The all-versions scope of this advisory is a reminder that authentication mechanisms in legacy OT software deserve independent scrutiny. Defenders should not assume that a password prompt in an engineering tool constitutes a meaningful security boundary until that implementation has been validated.
