{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/motion-control-settings-all-versions/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-15688"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GX Works3 (all versions)","Motion Control Settings (all versions)"],"_cs_severities":["high"],"_cs_tags":["industrial-control-systems","cve","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Mitsubishi Electric"],"content_html":"\u003cp\u003eMitsubishi Electric GX Works3 and the bundled Motion Control Settings software are affected by an authentication algorithm flaw (CVE-2026-15688), classified as CWE-303. This vulnerability stems from an incorrect implementation that allows a local user to bypass security controls. By executing the application and performing memory manipulation to alter parts of the loaded executable module, an attacker can circumvent password validation mechanisms. Successful exploitation grants the attacker the ability to view, tamper with, destroy, or delete critical control programs used in industrial manufacturing environments. Given the potential impact on control logic, the vulnerability is highly critical in operational technology (OT) settings where integrity of control programs is essential for safety and uptime.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects users of Mitsubishi Electric GX Works3 and Motion Control Settings worldwide, particularly within the critical manufacturing sector. Successful exploitation leads to total loss of integrity and availability of control programs, potentially resulting in unauthorized process modification or operational disruption. The vulnerability is assigned a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 9.2 (Critical).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Mitsubishi Electric GX Works3 to version 1.096A or later to address CVE-2026-15688.\u003c/li\u003e\n\u003cli\u003eUpdate Motion Control Settings to version 1.070Y or later.\u003c/li\u003e\n\u003cli\u003eFollowing the update, configure the security version for projects to \u0026quot;2\u0026quot; as detailed in the Mitsubishi Electric security manual.\u003c/li\u003e\n\u003cli\u003eRestrict local physical access to workstations running the affected software and implement rigorous access controls for all users who interact with these machines.\u003c/li\u003e\n\u003cli\u003eDeploy endpoint security solutions to monitor for suspicious process injection or memory modification attempts on engineering workstations.\u003c/li\u003e\n\u003cli\u003eIsolate control system networks from untrusted networks and the internet, ensuring remote access is restricted to authenticated, VPN-secured connections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-17T17:11:14Z","date_published":"2026-09-17T17:11:14Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mitsubishi-authentication-bypass/","summary":"An incorrect implementation of the authentication algorithm (CVE-2026-15688) in Mitsubishi Electric GX Works3 and Motion Control Settings allows local attackers to bypass block password protections and manipulate control programs.","title":"Authentication Bypass Vulnerability in Mitsubishi Electric GX Works3","url":"https://feed.craftedsignal.io/briefs/2026-09-mitsubishi-authentication-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Motion Control Settings (All Versions)","version":"https://jsonfeed.org/version/1.1"}