Compromised Workstations Can Defeat Project Passwords
An ordinary local user can alter the running tool’s executable memory and pass its block-password check with a wrong secret, without anyone else participating. CVE-2026-15688 affects every GX Works3 release and bundled Motion Control Setting. Reading, changing or erasing controller code becomes possible. Severity is in the top band: 9.2 (CVSS 4.0). Remote PLC takeover is not established.
For GX Works3, update to version 1.096A or later and set the project’s security version to 2. For the bundled Motion Control Setting, update to version 1.070Y or later and set its project’s security version to 2. Mitsubishi Electric also requires the GX Works3 measure when using Motion Control Setting, so updating the bundled tool on its own does not complete the stated workaround.
The vendor’s and later JVN’s notices appeared on 17 and 24 September respectively. No reviewed primary confirms exploitation; catalogue absence cannot exclude it.
Project files and trusted controller routes make workstation integrity consequential.
- Inventory laptops, jump hosts, vendor and offline stations.
- Record software builds and each project’s settings.
- Restrict debuggers, memory tools and unapproved execution.
- Compare programmes with approved copies; retain signatures or checksums.
- Separate ordinary-account credentials from controller administration.
- Preserve workstation and controller evidence before restoring uncertain projects.
