Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and…

CVE-2026-15688 is an incorrect implementation of the authentication algorithm (CWE-303) in Mitsubishi Electric GX Works3 (all versions before 1.096A) and Motion Control Settings (all versions before 1.070Y). The flaw lets a local, low-privileged user bypass the *block password* — the application-level lock that restricts viewing and editing of specific PLC program blocks — by attaching to the running GX Works3 process and patching the authentication check in memory. Once bypassed, the attacker can view, tamper with, destroy, or delete control programs destined for MELSEC iQ-R and iQ-F safety and standard PLCs. Every version ever shipped is affected.

CISA published ICSA-26-260-02 on September 17, 2026 with a CVSS v4.0 score of 9.2 CRITICAL and a v3.1 score of 8.8 HIGH. The v4.0 score appropriately captures the *Changed Scope* — impact extends from the engineering workstation to downstream PLCs — but it overstates urgency by not sufficiently weighting the local-only attack vector. The attacker must already be sitting at (or have compromised) the GX Works3 engineering workstation. In properly segmented ICS environments, that is a high-friction prerequisite. The real danger is the insider threat / post-compromise scenario: a disgruntled operator or a compromised workstation pivoting to PLC program sabotage. That scenario is absolutely real in OT, which is why this floors at HIGH despite the local vector.

Why this verdict

• Local-only vector with process-ownership semantics: The attacker patches their own GX Works3 process in memory — no privilege escalation needed, but they must already have interactive access to the engineering workstation. This is a genuine friction point that narrows the reachable population to insiders and post-compromise scenarios.
• Role multiplier — canonical OT/ICS engineering tool: GX Works3 exists solely to program MELSEC PLCs. 100% of installations are in industrial/critical infrastructure contexts. The chain ends in PLC program tampering → safety interlock bypass → potential physical damage. This is textbook OT-safety impact, which sets a verdict floor of HIGH per the high-value-role catalog.
• All versions affected, patch just released: Every GX Works3 installation ever deployed is vulnerable. The patch (1.096A) dropped September 17, 2026. OT environments are notoriously slow to patch engineering software due to validation requirements, so the exposure window will be long.
• No public PoC or active exploitation — prevents CRITICAL: The memory-patching technique is straightforward for a skilled reverser, but no exploit code is public, no campaigns are attributed, and CISA has not added this to KEV. This absence of weaponization evidence keeps the verdict below CRITICAL.
• Historical pattern of GX Works3 auth flaws: CVE-2022-29830 (hardcoded crypto keys), CVE-2022-29831 (hardcoded passwords), CVE-2022-29832 (cleartext storage), and CVE-2023-4088 all targeted authentication and credential protection in GX Works3. This is a systemic weakness in the product's security architecture, increasing the probability that researchers or attackers will chain this with prior knowledge.

Why not higher?

A CRITICAL assessment would require either active exploitation evidence, a public weaponized PoC, or a remote/network attack vector. This CVE requires local interactive access to the engineering workstation — a significant barrier even in the OT threat model. The absence of any in-the-wild exploitation, KEV listing, or public exploit code further argues against CRITICAL. The attack also bypasses an *application-level* block password, not OS or network authentication, limiting the blast radius to the specific project the user has open.

Why not lower?

The affected component is canonical OT/ICS engineering software — every installation directly programs PLCs that control physical processes. Successful exploitation enables safety interlock tampering and potential physical damage, which is the highest-consequence outcome class in the OT threat model. The floor rule for OT-safety impact with a canonically high-value component prevents any assessment below HIGH. Additionally, all versions are affected, the technique requires only low privileges and standard user-mode debugging capabilities, and Mitsubishi's track record of authentication flaws in this product line suggests the weakness is architecturally deep.

1. Deploy EDR with debugger-attachment detection on all GX Works3 workstations — The attack requires attaching a debugger to the GX Works3 process. EDR products that alert on PROCESS_VM_WRITE or debugger attachment to non-developer processes will catch this technique. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity. Configure Sysmon Event ID 10 to log cross-process access targeting GX Works3 executables.
2. Enable application whitelisting on engineering workstations — Block execution of unauthorized debuggers (x64dbg, WinDbg, OllyDbg) and scripting tools on OT engineering workstations. Windows Defender Application Control (WDAC) or a dedicated OT endpoint protection product can enforce this. This directly prevents Step 3 of the attack chain.
3. Implement project file integrity monitoring — Hash or digitally sign golden-copy PLC project files and monitor for unauthorized changes. Compare project files against baselines before any PLC download operation. This detects post-exploitation tampering even if the authentication bypass succeeds.
4. Restrict PLC download operations to authorized change windows — Configure PLC key-switches to STOP or use MELSOFT authentication (where supported) to prevent unauthorized program downloads. Require two-person integrity for any PLC program change in safety-critical systems.
5. Upgrade to GX Works3 1.096A and set Security Version to 2 — This is the definitive fix. After upgrading, open each project and set the Security Version to 2 in project properties to enable the corrected authentication algorithm. Plan and execute within the noisgate remediation SLA of 180 days for HIGH severity, prioritizing safety-critical systems first.

Run this script on each Windows host where GX Works3 is installed, using any user account (no admin required). Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-15688.ps1. The script checks the installed GX Works3 version against the patched version 1.096A.

#Requires -Version 5.1
# Check-CVE-2026-15688.ps1
# Checks whether GX Works3 is patched against CVE-2026-15688
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'
$patchedVersion = [version]'1.96.0'  # 1.096A maps to file version 1.96.x

# Common install paths for GX Works3
$searchPaths = @(
    'C:\Program Files\MELSOFT\GX Works3',
    'C:\Program Files (x86)\MELSOFT\GX Works3',
    'C:\MELSOFT\GX Works3'
)

# Also check registry for install location
$regPaths = @(
    'HKLM:\SOFTWARE\MITSUBISHI ELECTRIC\GX Works3',
    'HKLM:\SOFTWARE\WOW6432Node\MITSUBISHI ELECTRIC\GX Works3'
)

$installDir = $null
foreach ($rp in $regPaths) {
    if (Test-Path $rp) {
        $val = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).InstallDir
        if ($val -and (Test-Path $val)) { $installDir = $val; break }
    }
}

if (-not $installDir) {
    foreach ($sp in $searchPaths) {
        if (Test-Path $sp) { $installDir = $sp; break }
    }
}

if (-not $installDir) {
    Write-Host 'UNKNOWN - GX Works3 installation not found on this host.'
    exit 2
}

# Find the main executable
$exePath = Join-Path $installDir 'GXW3.exe'
if (-not (Test-Path $exePath)) {
    $exePath = Get-ChildItem -Path $installDir -Filter 'GXW3.exe' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1 -ExpandProperty FullName
}

if (-not $exePath -or -not (Test-Path $exePath)) {
    Write-Host "UNKNOWN - GX Works3 directory found at $installDir but GXW3.exe not located."
    exit 2
}

try {
    $fileVer = (Get-Item $exePath).VersionInfo.FileVersion
    $prodVer = (Get-Item $exePath).VersionInfo.ProductVersion
    # Parse version - handle Mitsubishi version format
    $verObj = [version]((Get-Item $exePath).VersionInfo.FileVersionRaw)
    
    Write-Host "GX Works3 found: $exePath"
    Write-Host "File version:    $fileVer"
    Write-Host "Product version: $prodVer"
    Write-Host "Patched version: >= 1.096A (file version $patchedVersion)"
    Write-Host '---'
    
    if ($verObj -ge $patchedVersion) {
        Write-Host 'PATCHED - GX Works3 version is 1.096A or later. CVE-2026-15688 is remediated.'
        Write-Host 'NOTE: Also verify Security Version is set to 2 in each project.'
        exit 0
    } else {
        Write-Host "VULNERABLE - GX Works3 version $fileVer is below 1.096A. CVE-2026-15688 applies."
        Write-Host 'ACTION: Upgrade to GX Works3 1.096A+ and set Security Version to 2.'
        exit 1
    }
} catch {
    Write-Host "UNKNOWN - Error reading version info from $exePath : $_"
    exit 2
}

Sources

1. CISA ICS Advisory ICSA-26-260-02
2. Strix AI — CVE-2026-15688 Detail
3. Assurant Cyber — ICSA-26-260-02 Analysis
4. Nozomi Networks — GX Works3 Safety PLC Security Flaws
5. OpenCVE — CVE-2026-15688
6. OffSeq Threat Radar — CVE-2026-15688
7. Mitsubishi Electric PSIRT — Authentication Bypass Advisory (2023)