# CVE-2026-13584: Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

> An attacker on the network can tamper with control data and cause denial of service in Mitsubishi industrial devices via crafted packets.

- **Severity:** High 7.1 (`CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 30 Jul 2026
- **Updated:** 17 Sep 2026
- **Also known as:** GHSA-r2qx-6p3c-jwf2

## What is CVE-2026-13584?

CVE-2026-13584 is a high-severity vulnerability in Mitsubishi Electric Corporation AC Servo MELSERVO-J5 MR-J5-G, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, MELSEC iQ-L Series Motion Module, Motion Control Board, Block-type remote module, Block-type remote module with safety functions, Analog-Digital converter module, Digital-Analog converter module, CC-Link IE TSN compatible coupler, FPGA module, Tension meter, AC Servo MELSERVO-J5, AC Servo MELSERVO-JET, Liner Track System MTR-S series Linear track control module, Inverter FR-A800/F800/E800 Series, Industrial Robot CR800-D series controller Network Base Card, CC-Link IE TSN expansion unit, CC-Link IE TSN-CC-Link IE Field Network bridge module, CC-Link IE TSN-AnyWireASLINK bridge module, Energy Measuring Unit CC-Link IE TSN Communication Unit, GOT3000 Series, CC-Link IE TSN Communication Unit, Motion Control Software, CC-Link IE TSN Communication Software for Windows, Analysis Support Software MELSOFT VIMA, Master/Local module Designated communication LSI DeviceKit, Remote Station Communication LSI with GbE-PHY, CC-Link IE TSN Master/Local module Designated communication LSI SDK, and Remote station software development kit allows an attacker with access to a CC-Link IE TSN network to tamper with communication data (control input/output values) by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.

Weakness: CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel)

## Which versions are affected by CVE-2026-13584?


## How do I fix CVE-2026-13584?

No fix has been published for CVE-2026-13584 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-13584 being exploited?

There is no known exploitation of CVE-2026-13584 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-13584 and fix it if it is affected.

What it is: CVE-2026-13584 is a high-severity vulnerability in Mitsubishi Electric Corporation AC Servo MELSERVO-J5 MR-J5-G, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-13584 in the wild and no public exploit code.

Affected product: Mitsubishi Electric Corporation AC Servo MELSERVO-J5 MR-J5-G. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-13584/ (Markdown: https://insights.sbomify.com/CVE-2026-13584/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-13584
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13584
- OSV: https://osv.dev/vulnerability/CVE-2026-13584

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-13584/
Summaries are generated and may contain mistakes; the official description above is the record.