CVE-2026-13584 Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol
An attacker on the network can tamper with control data and cause denial of service in Mitsubishi industrial devices via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13584?
CVE-2026-13584 is a high-severity vulnerability in Mitsubishi Electric Corporation AC Servo MELSERVO-J5 MR-J5-G, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.
Weakness: CWE-924
Which versions are affected by CVE-2026-13584?
How do I fix CVE-2026-13584?
No fix has been published for CVE-2026-13584 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13584 being exploited?
There is no known exploitation of CVE-2026-13584 in the wild and no public exploit code.
Sources
Also known as GHSA-r2qx-6p3c-jwf2.