TI-2026-07742 Aliases CVE-2026-8806 GHSA-8vpf-2whm-fffj

Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module

MEDIUM 45CWE-440Published 2026-06-19 · Updated 2026-06-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a denial-of-service (DoS) condition in the affected product by continuously sending a large number of communication packets to the Ethernet port of the product in a short period of time, increasing the processing load of the product, preventing the internal anomaly-detection processing from being performed, and causing the communication function to stop.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00637 50th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Mitsubishi Electric Corporation	Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP	All versions	—	No fix listed	CNA

Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP VendorMitsubishi Electric Corporation Affected All versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-8806
2026-10-03 Alias added: GHSA-8vpf-2whm-fffj
2026-10-25 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-003_en.pdf

Other 2

TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8

See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences