# CVE-2026-15688: Mitsubishi Electric GX Works3 authentication bypass in block password

Source: https://junglewise.ai/threats/cve-2026-15688-mitsubishi-electric-gx-works3-authentication-bypass-in-block  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-15688 · Severity: high · CVSS 8.8 · Published 2026-09-17

Mitsubishi Electric GX Works3 and Motion Control Settings are software tools used to program and configure industrial control systems in manufacturing environments. A flaw in how the software validates block passwords allows a local attacker to bypass password protection and gain unauthorized access to modify control programs. Successful exploitation could enable tampering with, destroying, or deleting critical industrial control logic, potentially disrupting manufacturing operations.

Vendors: [Mitsubishi Electric](https://junglewise.ai/threats/vendors/mitsubishi-electric).

## Quick answers

**Is CVE-2026-15688 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15688 being exploited in the wild.

**How severe is CVE-2026-15688?** High severity, with a CVSS score of 8.8, published 17 September 2026.

**Which products and versions are affected?** Mitsubishi Electric GX Works3 all versions; Mitsubishi Electric Motion Control Settings all versions.

**Is there a fix for CVE-2026-15688?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15688 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-15688?** Check whether you run Mitsubishi Electric GX Works3 or Mitsubishi Electric Motion Control Settings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an incorrect implementation of authentication algorithm vulnerability (CWE-303) in Mitsubishi Electric GX Works3 and Motion Control Settings. The affected products fail to properly validate block passwords, allowing a local attacker to execute the product and modify executable modules in memory, thereby circumventing password-based access controls. The attack vector is local with low privilege requirements and no user interaction needed. The vulnerability permits an attacker to view, tamper with, destroy, or delete control programs used in industrial control systems. Patches are available: GX Works3 version 1.096A or later and Motion Control Settings version 1.070Y or later include a security version setting that must be configured to version "2" to remediate the issue.

## Affected products

- Mitsubishi Electric GX Works3 all versions
- Mitsubishi Electric Motion Control Settings all versions

## Timeline

- 2026-09-17: disclosed

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02](https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02)