Mitsubishi GX Works3 authentication bypass patched
An authentication algorithm flaw in Mitsubishi Electric GX Works3 and Motion Control Settings lets a local attacker bypass block password checks and tamper with control programs.
CISA republished a Mitsubishi Electric advisory (2026-007) describing CVE-2026-15688, an Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability affecting all versions of GX Works3 and its packaged Motion Control Settings software. A local attacker who executes the affected product can authenticate successfully even with an invalid block password by modifying part of the executable module in memory, allowing them to view, tamper with, destroy, or delete control programs on engineering workstations used to configure Mitsubishi Electric PLCs and motion controllers.
The affected products are widely deployed worldwide within the Critical Manufacturing sector and broader ICS environments. There is no indication in the advisory of active exploitation in the wild; this is a vendor-disclosed vulnerability reported by researchers Mayeul Fargier, Erwan Cordier, and Noé Flatreaud. Mitsubishi Electric has released fixed versions (GX Works3 v1.096A or later, Motion Control Settings v1.070Y or later) and recommends setting the project security version to "2" after upgrading.
Defenders should prioritize applying the vendor patches and enabling the security version setting, restrict network and physical access to engineering workstations running these tools, isolate control system networks from business networks and the internet, use VPNs for any required remote access, and follow standard ICS defense-in-depth practices (firewalls, no direct internet exposure, antivirus, user awareness against phishing links/attachments).
Mentioned in this report
Detection guidance
GX Works3 Process Memory Modification Attempt
Detects suspicious memory write operations targeting GX Works3 or Motion Control Settings executables, indicative of runtime authentication bypass via memory manipulation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GX Works3 Process Memory Modification Attempt
description: Detects attempts to modify GX Works3.exe or MotionControlSettings.exe
in memory, a technique used to bypass block password authentication (CVE-2026-15688).
Targets process injection or direct memory access patterns.
tags:
- attack.t1565
- attack.impact
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
GrantedAccess|endswith:
- '0x1400'
- '0x1200'
- '0x0428'
- '0x0038'
filter_self:
SourceImage|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
condition: selection and not filter_self
falsepositives:
- Debuggers or legitimate profiling tools attached by authorized developers
- EDR/antivirus memory scanning on the process
level: high
id: 32e48be6-cd98-580e-8732-228729641c0f
status: experimental
author: Vorant
Suspicious Module Load into GX Works3 or Motion Control Settings
Detects abnormal DLL injection or module loading into GX Works3 or Motion Control Settings processes, potentially used to modify authentication logic at runtime. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Module Load into GX Works3 or Motion Control Settings
description: Detects DLL injection or module loading into GX Works3.exe or MotionControlSettings.exe
from unusual sources, potentially modifying authentication logic to bypass block
password checks (CVE-2026-15688).
tags:
- attack.t1556
- attack.defense-evasion
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
ImageLoaded|endswith: .dll
filter_system:
ImageLoaded|startswith:
- C:\\Windows\\
- C:\\Program Files\\Mitsubishi Electric\\
filter_msvcrt:
ImageLoaded|contains:
- msvc
- kernel32
- ntdll
- user32
condition: selection and not filter_system and not filter_msvcrt
falsepositives:
- Legitimate third-party plugins or extensions installed for GX Works3
- User-installed development or testing tools
level: medium
id: 7b3bbebd-69fe-5202-84f4-81e0d9dbae66
status: experimental
author: Vorant
GX Works3 Privilege or Capability Escalation via Authentication Bypass
Detects unauthorized access to control programs or project files within GX Works3 or Motion Control Settings without valid credentials, indicating successful authentication bypass exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GX Works3 Unauthorized Project File Access After Failed Authentication
description: Detects access to GX Works3 or Motion Control Settings project files
(.gxw, .mpd, .plc) following failed or suspicious authentication attempts, suggesting
CVE-2026-15688 exploitation to view/modify control programs without valid block
password.
tags:
- attack.t1556
- attack.impact
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \GX Works3.exe
- \MotionControlSettings.exe
TargetFilename|endswith:
- .gxw
- .mpd
- .plc
Disposition: Success
filter_interactive_user:
User|contains: $
condition: selection and not filter_interactive_user
falsepositives:
- Legitimate engineer access to projects during normal operation
- Authorized remote engineering sessions via VPN
level: low
id: 022e3b7e-567f-5b50-b5b3-cef86769697f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free