In brief · As of October 2026
A Mitsubishi plant consists of MELSEC iQ-R or iQ-F controllers with modules on the base unit or extension modules, remote I/O and drive stations via CC-Link IE TSN or CC-Link IE Field, MR-J servos, GOT HMIs and EtherNet/IP modules. From the maintenance PC the CPU answers SLMP ‘Read Type Name’ with model name and type code, EtherNet/IP modules (FX5-ENET/IP, RJ71EIP91) answer ListIdentity; the modules in the rack and the CC-Link stations are seen only by the controller. They get into the device list via the system monitor of GX Works3 online (module type, serial number and firmware per slot and per station) or the project, with module type and firmware string in the notation of the advisories. Mitsubishi publishes as PDF, without its own [CSAF](/glossar/#csaf); CISA provides machine-readable documents: 136 entries related to Mitsubishi, 10 new in 2026. Mitsubishi names an SBOM as CRA evidence, there is no customer access; for the plant you do not need one.
What hangs on a MELSEC controller and what of it is visible on the network
The controller is an iQ-R CPU on the base unit with network, I/O and motion modules (RJ71, RX, RY, RD) or a compact iQ-F (FX5) with attached extension modules. Attached via CC-Link IE TSN or CC-Link IE Field are remote I/O stations, inverters and MR-J servos, via Ethernet GOT HMIs, MELSEC partner stations and EtherNet/IP devices.
- Visible via IP from the maintenance PC: iQ-R and iQ-F CPUs via SLMP ‘Read Type Name’ (model name, type code), EtherNet/IP modules (FX5-ENET/IP, RJ71EIP91) via ListIdentity, GOT HMIs via web identification; whether the CPUs run an SNMP agent we could not verify.
- Only via the controller: the modules on the base unit and the extension modules of an FX5, as well as the CC-Link IE Field stations behind the network module. CC-Link IE TSN stations answer SLMP themselves depending on the device, but most only via the network module.
- Only from the engineering: firmware versions shown only by the module diagnostics, and the assignment of stations to the sub-plant.
How rack modules and CC-Link stations get into the list: GX Works3 and the network module
The system monitor in GX Works3 shows the base unit online with module type, serial number and firmware version per slot and, via the network diagnostics, the stations on CC-Link IE with type and version. The project (GX Works3, MELSOFT iQ Works) keeps the same list as the planned state. From the network, the following are added:
- GX Works3 / MELSOFT iQ Works: project with CPU and module types; the firmware version is shown in the module diagnostics.
- SLMP “Read Type Name” (command 0101): returns model name and type code of the CPU via the MELSEC protocol – vendor-specific, but documented.
- EtherNet/IP modules (FX5-ENET/IP, RJ71EIP91) answer ListIdentity with the Identity Object; CC-Link IE TSN devices only via the network module. We could not verify whether the MELSEC CPUs run an SNMP agent. Background in the article on the network scan.
How Mitsubishi Electric publishes advisories and what matching runs on
The PSIRT's vulnerability list carries PDFs with an RSS feed; the FA list assigns them to product areas. There is no CSAF provider under mitsubishielectric.com or .co.jp, and no entry in the BSI aggregator or at CERT@VDE. Because Mitsubishi coordinates every advisory with CISA, CISA's OT CSAF feed is the machine-readable substitute.
| Measurement (7 Oct 2026) | Result |
|---|
| CISA OT feed: entries mentioning Mitsubishi in total | 136 |
| of which newly published in 2026 | 10 |
| of which updated in 2026 | 24 |
| Own numbering (FA page) | around 140 IDs since 2019, 2026: 6 |
| Latest advisory | 2026-007 (17 Sep 2026): GX Works3, CVE-2026-15688, CVSS 4.0 = 9.2 |
| CPE / PURL in the CISA CSAF (sample ICSA-26-169-05) | 0 / 0 |
The 2026 advisories cut across the portfolio: iQ-R CPUs, iQ-F network modules (FX5-ENET/IP, FX5-EIP), CNC controllers, GENESIS64/ICONICS, MELSOFT Update Manager, the CC-Link IE TSN protocol and GX Works3. Half of them concern engineering software on Windows PCs, not controller hardware.
Mitsubishi writes affected versions as “versions 1.106 and prior” and explains in the PDF under “How to check the versions” where to read the version. The device list must carry the firmware string in exactly this notation (series, model, version), otherwise the comparison fails on spelling. With ten new and 24 updated CISA entries in nine months, Mitsubishi is the most active manufacturer in this series after Siemens, Rockwell and Schneider – for a manufacturer whose advisories many German plant builders do not monitor at all.
What a manufacturer without CSAF means for monitoring is covered in the article on suppliers without CSAF.
Mitsubishi names an SBOM as CRA evidence in its press release of February 2026, we did not find any customer access; for the plant you do not need one.
What this means for installations with Mitsubishi components
- Record module type and firmware string for each CPU, network module and GOT – in the notation of the advisories.
- Keep GX Works3, MELSOFT and GENESIS64 in the software inventory of the engineering and HMI PCs.
- Document the support period per product as soon as the announced conformity list appears.
Ten new and 24 updated advisories in nine months, and half the devices hang behind the network module where only GX Works3 looks. In Werkspilot Scan, Mitsubishi is stage 2 for CPUs, EtherNet/IP modules and GOTs via SLMP, ListIdentity and web identification, and stage 3 for rack modules and CC-Link stations via the controller. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
