---
id: CVE-2026-15688
title: >-
  Incorrect Implementation of Authentication Algorithm Vulnerability in
  Mitsubishi Electric GX Works3 and Motion Control Setting allows a local
  attacker to successfully authenticate even with an invalid block password by
  executing the affe…
summary: >-
  Incorrect Implementation of Authentication Algorithm Vulnerability in
  Mitsubishi Electric GX Works3 and Motion Control Setting allows a local
  attacker to successfully authenticate even with an invalid block password by
  executing the affe…
severity: critical
cvss: 9.2
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:H/SA:H'
cwe:
  - CWE-303
vendor: Mitsubishi Electric Corporation
product: GX Works3
affected:
  - gx_works3 All versions
  - motion_control_setting All versions
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:29:56.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15688'
references:
  - url: 'https://jvn.jp/vu/JVNVU99700314'
    label: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
  - url: 'https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-007_en.pdf'
    label: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
tags:
  - nvd
  - cve.org
epss: 0.00121
epssPercentile: 0.01684
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T12:24:48.176339Z'
cvssSource: cna
ingestedAt: '2026-09-17T09:14:58.452Z'
---

## Overview

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.