Which versions of MELSEC iQ-F FX5-ENET/IP are affected by CVE-2026-8806?

Mitsubishi Electric PLC modules critical to manufacturing and industrial operations are vulnerable to remote denial-of-service attacks that can halt communication-causing production stoppages in…

How to fix or mitigate CVE-2026-8806?

Within 24 hours: Inventory all systems running MELSEC iQ-F Series FX5-ENET/IP Ethernet Modules; implement network segmentation to isolate affected devices from untrusted network access. Within 7 days: Deploy rate limiting and ingress filtering rules on network perimeter; establish network monitoring for packet-flood anomalies; restrict Ethernet module access to whitelisted IP sources only. Within 30 days: Monitor Mitsubishi Electric security advisories for patch release; evaluate redundant or failover PLC configurations; assess long-term hardware upgrade path if patches remain unavailable.

MELSEC iQ-F FX5-ENET/IP CVE-2026-8806

Q: What is the CVSS score of CVE-2026-8806?

CVE-2026-8806 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37975 HIGH

Expected Behavior Violation (CWE-440)

2026-06-19 Mitsubishi

GHSA-8vpf-2whm-fffj

Information Disclosure Mitsubishi Electric Melsec Iq F Series Fx5 Enet Ip Ethernet Module Fx5 Enet Ip

8.7

CVSS 4.0 · Vendor: Mitsubishi

Severity by source

Vendor (Mitsubishi) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable Ethernet port, no auth or user interaction, trivial packet flood, impact limited to availability of the module - no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mitsubishi).

CVSS VectorVendor: Mitsubishi

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 03:16 vuln.today

DescriptionCVE.org

Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being performed, and causing the communication function to stop.

AnalysisAI

Denial-of-service in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Modules (all versions) allows unauthenticated remote attackers to halt the module's communication function by flooding its Ethernet port with packets. The high packet rate overwhelms internal anomaly-detection processing and stops communications - a critical impact for the industrial control environments these PLCs operate in. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects high availability impact in operational technology contexts.

Technical ContextAI

The FX5-ENET/IP is a CIP/EtherNet IP communications module for Mitsubishi's MELSEC iQ-F micro PLC family, used to interconnect controllers with field devices and SCADA systems on plant networks. CWE-440 (Expected Behavior Violation) captures that the module fails to behave as designed under sustained packet load: the internal anomaly-detection (rate/health monitoring) routine is starved of CPU time by the packet processing path, and the communication stack ultimately stops servicing traffic. The affected CPE covers all firmware versions of the FX5-ENET/IP module, indicating a design-level resource-handling weakness rather than a regression in a specific release.

RemediationAI

No vendor-released patch version is cited in the available data; consult the Mitsubishi PSIRT advisory at https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-003_en.pdf and the CISA ICS advisory https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-06 for the current firmware fix and recovery procedure (the module typically requires a power cycle to restore communications after the DoS condition). Until a fix is applied, isolate the FX5-ENET/IP module on a dedicated control-network segment with firewall rules permitting only required EtherNet/IP peers, deploy an industrial IDS/firewall capable of EtherNet/IP rate limiting in front of the module, and disable any unused services on the module - note that aggressive rate limiting may interrupt legitimate high-rate I/O traffic during scan-cycle peaks and should be tuned with the process engineer. Maintain physical access controls and ensure the OT network is not directly reachable from the corporate network or internet, consistent with ISA/IEC 62443 zone-and-conduit guidance.