CVE record · CVE-2026-13584

Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

CVSS 7.1 HighEPSS 0.0019 · 8th percentile

Published by the CVE Program (CNA: Mitsubishi) at 30 Jul 2026, 06:44 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric Corporation	MELSEC MX Controller MX-R model MXR300-16	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-R model MXR300-32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-R model MXR300-64	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-R model MXR500-128	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-R model MXR500-256	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100-8-N32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100-8-P32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100-16-N32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100-16-P32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-N32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-P32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-8-N32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-8-P32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-16-N32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC MX Controller MX-F model MXF100S-16-P32	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Master/local module RJ71GN11-T2	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Master/local module RJ71GN11-SX	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Master/local module RJ71GN11-EIP	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Master/local module FX5-CCLGN-MS	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	CC-Link IE TSN interface board NZ81GN11-SX	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	CC-Link IE TSN interface board NZ81GN11-T2	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78G4	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78G8	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78G16	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78G64	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78GHV	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module RD78GHW	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module FX5-40SSC-G	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion module FX5-80SSC-G	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC iQ-L Series Motion Module LD78G4	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC iQ-L Series Motion module LD78G16	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Motion Control Board MR-EM441G	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2S1-32D	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2S1-32T	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2S1-32TE	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2S1-32DT	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2S1-32DTE	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2B1-32D	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2B1-32T	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Block-type remote module NZ2GN2B1-32TE	affected all versions Other versions: unaffected

And 82 more products. The full list is on the CVE record.

Identifiers: CVE-2026-13584
CNA: Mitsubishi
Weakness (CWE): CWE-924
Tags: Mitsubishi Electric Corporation MELSEC MX Controller MX-R model MXR300-16
Mitsubishi Electric Corporation MELSEC MX Controller MX-R model MXR300-32
Mitsubishi Electric Corporation MELSEC MX Controller MX-R model MXR300-64
Mitsubishi Electric Corporation MELSEC MX Controller MX-R model MXR500-128
Mitsubishi Electric Corporation MELSEC MX Controller MX-R model MXR500-256
Mitsubishi Electric Corporation MELSEC MX Controller MX-F model MXF100-8-N32
Mitsubishi Electric Corporation MELSEC MX Controller MX-F model MXF100-8-P32
Mitsubishi Electric Corporation MELSEC MX Controller MX-F model MXF100-16-N32
CWE-924
Published: 30 Jul 2026
Updated: 5 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.1	High	4.0	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N	CNA (Mitsubishi)

CISA KEV Not listed.
EPSS 0.0019, the 8th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

30 Jul 2026, 06:44 UTC Confirmed by the CVE List
30 Jul 2026, 07:16 UTC Confirmed by NVD

Sources

References from the CNA

www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-005_en.pdf vendor-advisory
jvn.jp/vu/JVNVU98879231/ government-resource
www.cisa.gov/news-events/ics-advisories/icsa-26-211-07 government-resource

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.