Mitigating CVE-2026-15688: Critical Security Posture for Mitsubishi GX Works3

Mitsubishi Electric’s GX Works3 engineering software is currently exposed to a severe vulnerability, CVE-2026-15688, which permits local adversaries to bypass standard authentication protocols. This flaw enables unauthorized users to tamper with critical control programs, posing a direct threat to operational integrity and industrial safety. The vulnerability is particularly concerning for tech environments where engineering workstations are not strictly isolated, as it lowers the barrier for malicious actors to manipulate PLC logic without triggering standard security alerts.

To neutralize this risk, immediate action is required. Operators must upgrade GX Works3 to version 1.096A and ensure Motion Control Settings are updated to version 1.070Y. Crucially, the project security version must be explicitly set to "2" to activate the corrected authentication algorithm. Beyond software patching, organizational security policies must reinforce network segmentation. Engineering stations should be strictly isolated from untrusted networks to mitigate the potential for local authentication bypass. This dual approach of technical remediation and architectural hardening is essential to protect critical infrastructure from sophisticated local threats.

Key Findings

• Vulnerability Scope: CVE-2026-15688 allows local attackers to bypass password protections and modify control programs.
• Required Patches: Update GX Works3 to v1.096A and Motion Control Settings to v1.070Y.
• Configuration Change: Set the project security version to "2" to enable the fixed authentication algorithm.
• Network Hygiene: Isolate engineering workstations from untrusted networks to reduce the attack surface for local exploits.

---

Original investigation and evidence breakdown published on Groundwork: Mitsubishi security vulnerability.