VulnSocial

CVE-2026-15688Disclosure

MEDIUMCVSS 9.2 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modifying part of the executable module in memory, and thereby may be able to view, tamper with, destroy, or delete control programs.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-303

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 3 mentions (2026-09-18); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-09-17: 1Mentions · 2026-09-18: 3Mentions · 2026-09-20: 1Active Exploitation · 2026-09-18: 1Patch / Workaround · 2026-09-17: 1Patch / Workaround · 2026-09-18: 2Technical Details · 2026-09-18: 3Technical Details · 2026-09-20: 109-1709-1809-20
Signal classification3 categories
Disclosure
360.0%
Patch
120.0%
Active Exploitation
120.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-171
Patch1
2026-09-183
Active Exploitation1Disclosure2
2026-09-201
Disclosure1
Full discourse5 posts
  • SecBriefs | Hungry to learn. Short on time.@SecBriefs
    Disclosure

    A local flaw could put control projects within reach. CISA rates CVE-2026-15688 at 8.8; invalid block passwords may expose GX Works3 programs. Check exposure, backups and local access before changing engineering systems. Get the brief → https://secbriefs.com/briefs/gx-works3-authentication-flaw-could-expose-industrial-control-programs #Cybersecurity https://t.co/GTqAhhsu0B

    Post summary

    The tweet discloses CVE-2026-15688, an authentication flaw in GX Works3 rated 8.8 by CISA, and advises checking exposure and backups before modifying engineering systems. No patch, exploit, or PoC is referenced.

    00000268
    14.1K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploiting CVE-2026-15688 bypass block password authentication in Mitsubishi Electric GX Works3 by modifying executable memory. Once inside industrial control systems, they pivot across operational networks to manipulate critical manufacturing processes. Runtime segmentation helps contain such post-compromise activity in OT environments. #ICSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/mitsubishi-electric-gx-works3-authentication-bypass-cve-2026-15688

    Post summary

    The text reports active attacker exploitation of CVE-2026-15688 to bypass authentication in Mitsubishi Electric GX Works3, followed by post-compromise activity in OT environments. It also mentions runtime segmentation as a containment mitigation.

    0000049
    2.0K followersView on X
  • CyberWorldOps@CyberWorldOps
    Disclosure

    Local bypass in Mitsubishi GX Works3 (CVE-2026-15688) lets attackers patch memory to defeat block-password auth and tamper with control programs. Patch now. #IcsSecurity #OtSecurity https://cyberworldops.eu/en/mitsubishi-engineering-tools-expose-control-programs-through-local

    Post summary

    The post discloses a local bypass vulnerability in Mitsubishi GX Works3 (CVE-2026-15688) enabling memory patching to defeat authentication, and urges patching without naming a specific fix or providing exploit details.

    0000029
    10 followersView on X
  • NEXSIGHT@NEXSIGHTNEWS
    Disclosure

    三菱電機のPLC設計ソフト「GX Works3」にブロックパスワード認証バイパス — CVE-2026-15688、CVSS 9.2 https://cyber.nexsight.co/articles/2026/09/18/mitsubishi-gx-works3-cve-2026-15688-block-password-bypass-2026-09-18/

    Post summary

    The text announces CVE-2026-15688 in Mitsubishi Electric GX Works3—a block password authentication bypass with CVSS 9.2—and links to a full article, with no patch, exploit, or PoC details in the text itself.

    0000075
    74 followersView on X
  • Windows Forum@windowsforum
    Patch

    ⚠️ Updating GX Works3 isn’t enough for CVE-2026-15688: every affected project must also be moved to security version 2. Patch the software, then patch the projects—or leave the door ajar. https://windowsforum.com/news/cve-2026-15688-gx-works3-must-set-security-version-2.444851/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #MitsubishiElectric #IndustrialCybersecurity #GxWorks3 #Cve202615688 https://t.co/m5Fp05mKot

    Post summary

    The tweet warns that updating the GX Works3 software alone is insufficient for CVE-2026-15688, emphasizing that affected projects must also be patched and moved to security version 2 to mitigate the risk.

    0000051
    1.4K followersView on X

Explore more

Back to dashboard