The password that is supposed to stop someone opening a Mitsubishi factory controller's program is not really checking the password. CISA published an advisory on September 17 saying a local attacker can run GX Works3, Mitsubishi Electric's engineering software for its programmable logic controllers, and authenticate successfully even with an invalid block password.
Getting past that prompt is the whole attack. CISA says the attacker can then modify part of the executable module in memory and go on to view, tamper with, destroy or delete control programs. The flaw is CVE-2026-15688, rated 8.8 out of 10, and the underlying weakness is an incorrect implementation of an authentication algorithm rather than a memory corruption bug, which is why no crafted input or exploit chain is involved.
Why a program block has a password at all
A programmable logic controller is the small industrial computer that actually opens a valve or starts a motor, and GX Works3 is where the logic it runs gets written. Block passwords exist so the recipe inside a machine, often the most valuable thing on a shop floor, cannot simply be read out or edited by whoever sits down at the engineering workstation. That same protection is what an attacker who has already reached that workstation would have to defeat before touching production logic, and CISA's advisory says they do not have to.
The exposure is unusually wide. Mitsubishi lists every version of both GX Works3 and the Motion Control Settings software bundled with it as affected, with no fixed release named. CISA files the advisory under critical manufacturing and records the deployment as worldwide.
The remedy is a setting, not a patch
There is no patched build to install. Mitsubishi's remedy is a workaround in two parts: move to GX Works3 version 1.096A or later, then set the security version for projects to "2", a per-project setting documented in the operating manual under preventing illegal access to and falsification of data. The version bump alone is not the fix, because Mitsubishi's instruction pairs it with that project setting, so someone has to walk through existing project files and change it. The same two steps apply to Motion Control Settings.
Because the attack is local, the practical control is who can reach an engineering workstation in the first place. CISA's standing guidance for control system networks applies: keep them off the open internet, put remote devices behind firewalls, isolate them from the business network, and use a VPN where remote access is needed. On this flaw the engineering PC is the perimeter.
Mitsubishi Electric's own advisory carries the detail and is published as PSIRT bulletin 2026-007, alongside CISA advisory ICSA-26-260-02. It was one of seven industrial advisories CISA released that day, and the second time this month the software sitting above the controllers, rather than the controllers themselves, turned out to be the soft spot: two days earlier the agency scored an unauthenticated command API in mySCADA's myPRO Manager at 9.8. Plant operators spend a great deal on hardening the machines. The laptop that programs them keeps getting less attention.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.