CVE-2026-15688: Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems where a local user can execute Mitsubishi Electric GX Works3 or Motion Control Setting are exposed. Exploitation requires the attacker to modify part of the affected executable module in memory.
What access does an attacker need to exploit it?
The attacker needs local access sufficient to run the affected product and alter its executable module in memory. The issue does not describe remote exploitation.
What could an attacker do after bypassing the block password?
An attacker may be able to view, tamper with, destroy, or delete control programs.