CVE-2026-13584: Mitsubishi Electric Multiple Products Message Integrity Failure in CC-Link IE TSN

CVE-2026-13584 · Severity: high · CVSS 7.1 · Published 2026-07-30

Mitsubishi Electric's CC-Link IE TSN communication protocol, used in industrial control systems to coordinate manufacturing equipment and factory automation, contains a vulnerability allowing network-based denial-of-service attacks. An attacker on the same network can craft specific timing-based packets to disrupt or corrupt communications between controllers and equipment, causing production systems to malfunction or halt. This affects dozens of Mitsubishi industrial automation products including PLCs, motion controllers, and remote modules used in factories worldwide.

Vendors: Mitsubishi Electric.

Quick answers

Is CVE-2026-13584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13584 being exploited in the wild.
How severe is CVE-2026-13584?
High severity, with a CVSS score of 7.1, published 30 July 2026.
Which products and versions are affected?
Mitsubishi Electric Analog-Digital Converter Module NZ2GN2B-60AD4 all; Mitsubishi Electric Analog-Digital Converter Module NZ2GN2S-60AD4 all; Mitsubishi Electric Block-Type Remote Module NZ2GN12A2-16T all; Mitsubishi Electric Block-Type Remote Module NZ2GN12A2-16TE all; and 55 more.
Is there a fix for CVE-2026-13584?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13584 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13584?
Check whether you run Mitsubishi Electric Analog-Digital Converter Module NZ2GN2B-60AD4, Mitsubishi Electric Analog-Digital Converter Module NZ2GN2S-60AD4, Mitsubishi Electric Block-Type Remote Module NZ2GN12A2-16T or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the CC-Link IE TSN communication protocol implementation across multiple Mitsubishi Electric products. An attacker with network access to the same segment can send specially crafted packets that exploit timing conditions to tamper with communication data, violating the integrity of control messages. The attack vector is network-based with adjacent/local network reachability required. Successful exploitation allows denial of service by interfering with control functions or inducing incorrect operation of affected industrial equipment. All versions of affected MELSEC MX controllers, motion modules, remote I/O modules, and interface boards are impacted. Mitigation details and patches are not specified in this advisory.

Affected products

  • Mitsubishi Electric MELSEC MX Controller MX-R MXR300-16
  • Mitsubishi Electric MELSEC MX Controller MX-R MXR300-32
  • Mitsubishi Electric MELSEC MX Controller MX-R MXR300-64
  • Mitsubishi Electric MELSEC MX Controller MX-R MXR500-128
  • Mitsubishi Electric MELSEC MX Controller MX-R MXR500-256
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100-8-N32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100-8-P32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100-16-N32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100-16-P32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-N32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-P32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-8-N32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-8-P32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-16-N32
  • Mitsubishi Electric MELSEC MX Controller MX-F MXF100S-16-P32
  • Mitsubishi Electric Master/local module RJ71GN11-T2 all
  • Mitsubishi Electric Master/local module RJ71GN11-SX all
  • Mitsubishi Electric Master/local module RJ71GN11-EIP all
  • Mitsubishi Electric Master/local module FX5-CCLGN-MS all
  • Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-SX all
  • Mitsubishi Electric CC-Link IE TSN interface board NZ81GN11-T2 all
  • Mitsubishi Electric Motion module RD78G4 all
  • Mitsubishi Electric Motion module RD78G8 all
  • Mitsubishi Electric Motion module RD78G16 all
  • Mitsubishi Electric Motion module RD78G64 all
  • Mitsubishi Electric Motion module RD78GHV all
  • Mitsubishi Electric Motion module RD78GHW all
  • Mitsubishi Electric Motion module FX5-40SSC-G all
  • Mitsubishi Electric Motion module FX5-80SSC-G all
  • Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G4 all
  • Mitsubishi Electric MELSEC iQ-L Series Motion Module LD78G16 all
  • Mitsubishi Electric Motion Control Board MR-EM441G all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-32D all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-32T all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-32TE all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-32DT all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-32DTE all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-32D all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-32T all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-32TE all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-32DT all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-32DTE all
  • Mitsubishi Electric Block-type remote module NZ2GNCF1-32D all
  • Mitsubishi Electric Block-type remote module NZ2GNCF1-32T all
  • Mitsubishi Electric Block-type remote module NZ2GNCE3-32D all
  • Mitsubishi Electric Block-type remote module NZ2GNCE3-32DT all
  • Mitsubishi Electric Block-type remote module NZ2GN12A4-16D all
  • Mitsubishi Electric Block-type remote module NZ2GN12A4-16DE all
  • Mitsubishi Electric Block-type remote module NZ2GN12A2-16T all
  • Mitsubishi Electric Block-type remote module NZ2GN12A2-16TE all
  • Mitsubishi Electric Block-type remote module NZ2GN12A42-16DT all
  • Mitsubishi Electric Block-type remote module NZ2GN12A42-16DTE all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-16D all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-16T all
  • Mitsubishi Electric Block-type remote module NZ2GN2S1-16TE all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-16D all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-16T all
  • Mitsubishi Electric Block-type remote module NZ2GN2B1-16TE all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8D-K all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-8TE-K all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNSS2-16DTE-K all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-14DT all
  • Mitsubishi Electric Block-type remote module with safety functions NZ2GNS12A2-16DTE all
  • Mitsubishi Electric Analog-Digital converter module NZ2GN2S-60AD4 all
  • Mitsubishi Electric Analog-Digital converter module NZ2GN2B-60AD4 all
  • Mitsubishi Electric Digital-Analog converter module NZ2GN2S-60DA4 all
  • Mitsubishi Electric Digital-Analog converter module NZ2GN2B-60DA4 all
  • Mitsubishi Electric CC-Link IE TSN compatible coupler NZ2FT-GN all
  • Mitsubishi Electric FPGA module NZ2GN2S-D41P01 all
  • Mitsubishi Electric FPGA module NZ2GN2S-D41D01 all
  • Mitsubishi Electric FPGA module NZ2GN2S-D41PD02 all

Timeline

  • 2026-09-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.