Mitsubishi GX Works3 authentication bypass patched
An authentication algorithm flaw in Mitsubishi Electric GX Works3 and Motion Control Settings lets a local attacker bypass block password checks and tamper with control programs.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished a Mitsubishi Electric advisory (2026-007) describing CVE-2026-15688, an Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability affecting all versions of GX Works3 and its packaged Motion Control Settings software. A local attacker who executes the affected product can authenticate successfully even with an invalid block password by modifying part of the executable module in memory, allowing them to view, tamper with, destroy, or delete control programs on engineering workstations used to configure Mitsubishi Electric PLCs and motion controllers.
The affected products are widely deployed worldwide within the Critical Manufacturing sector and broader ICS environments. There is no indication in the advisory of active exploitation in the wild; this is a vendor-disclosed vulnerability reported by researchers Mayeul Fargier, Erwan Cordier, and Noé Flatreaud. Mitsubishi Electric has released fixed versions (GX Works3 v1.096A or later, Motion Control Settings v1.070Y or later) and recommends setting the project security version to "2" after upgrading.
Defenders should prioritize applying the vendor patches and enabling the security version setting, restrict network and physical access to engineering workstations running these tools, isolate control system networks from business networks and the internet, use VPNs for any required remote access, and follow standard ICS defense-in-depth practices (firewalls, no direct internet exposure, antivirus, user awareness against phishing links/attachments).
Mentioned in this report
Detection guidance
GX Works3 Process Memory Modification Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious memory write operations targeting GX Works3 or Motion Control Settings executables, indicative of runtime authentication bypass via memory manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GX Works3 Process Memory Modification Attempt
description: Detects attempts to modify GX Works3.exe or MotionControlSettings.exe
in memory, a technique used to bypass block password authentication (CVE-2026-15688).
Targets process injection or direct memory access patterns.
tags:
- attack.t1565
- attack.impact
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
GrantedAccess|endswith:
- '0x1400'
- '0x1200'
- '0x0428'
- '0x0038'
filter_self:
SourceImage|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
condition: selection and not filter_self
falsepositives:
- Debuggers or legitimate profiling tools attached by authorized developers
- EDR/antivirus memory scanning on the process
level: high
id: 32e48be6-cd98-580e-8732-228729641c0f
status: experimental
author: Vorant
Suspicious Module Load into GX Works3 or Motion Control Settings
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects abnormal DLL injection or module loading into GX Works3 or Motion Control Settings processes, potentially used to modify authentication logic at runtime. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Module Load into GX Works3 or Motion Control Settings
description: Detects DLL injection or module loading into GX Works3.exe or MotionControlSettings.exe
from unusual sources, potentially modifying authentication logic to bypass block
password checks (CVE-2026-15688).
tags:
- attack.t1556
- attack.defense-impairment
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
ImageLoaded|endswith: .dll
filter_system:
ImageLoaded|startswith:
- C:\\Windows\\
- C:\\Program Files\\Mitsubishi Electric\\
filter_msvcrt:
ImageLoaded|contains:
- msvc
- kernel32
- ntdll
- user32
condition: selection and not filter_system and not filter_msvcrt
falsepositives:
- Legitimate third-party plugins or extensions installed for GX Works3
- User-installed development or testing tools
level: medium
id: 7b3bbebd-69fe-5202-84f4-81e0d9dbae66
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs