Is CVE-2026-8806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8806 being exploited in the wild.

How severe is CVE-2026-8806?

Informational severity, with a CVSS score of 8.7, published 19 June 2026.

Is there a fix for CVE-2026-8806?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8806 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-8806?

Check whether you run Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8806: Mitsubishi Electric MELSEC iQ-F FX5-ENET/IP denial of service

CVE-2026-8806 · Severity: info · CVSS 8.7 · Published 2026-06-19

The Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP is an Ethernet module used in industrial automation to manage communications for programmable logic controllers (PLCs). A vulnerability in this module allows a remote attacker to crash the device's communication functions by flooding it with network traffic. This results in a denial-of-service (DoS) condition that can disrupt industrial processes and prevent the system from detecting other operational anomalies.

Vendors: Mitsubishi Electric.

Quick answers

Is CVE-2026-8806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8806 being exploited in the wild.
How severe is CVE-2026-8806?: Informational severity, with a CVSS score of 8.7, published 19 June 2026.
Which products and versions are affected?: Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module All versions.
Is there a fix for CVE-2026-8806?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8806 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-8806?: Check whether you run Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An 'Expected Behavior Violation' (CWE-440) exists in the Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module. The vulnerability is triggered when the device receives a continuous stream of a large number of communication packets at its Ethernet port over a short duration. This flood increases the processing load to a point where internal anomaly-detection mechanisms fail and the communication function stops entirely. The attack can be launched remotely over the network without authentication. Mitsubishi Electric has stated that no firmware updates are planned for this module; instead, users are advised to implement network segmentation, IP filtering, and firewalls to mitigate the risk.

Affected products

Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP All versions

Timeline

2026-06-18: advisory: CISA and Mitsubishi Electric published advisories.
2026-06-19: disclosed: JVN advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.