CVE-2026-13584

CVE-2026-13584 is an "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" vulnerability affecting Mitsubishi Electric's CC-Link IE TSN industrial communication protocol. The flaw impacts a wide range of Mitsubishi Electric industrial products, including MELSEC controllers, AC servos, inverters, block-type remote modules, and compatible couplers. Because the protocol does not sufficiently validate that transmitted payloads remain unaltered, an attacker with access to the same network segment can exploit the vulnerability by sending specially crafted packets under specific timing conditions. Successful exploitation allows an attacker to tamper with communication data, including real-time control input and output values. This can lead to a denial-of-service (DoS) condition, disrupt deterministic control functions, or cause the affected industrial equipment to operate incorrectly. Since some affected models do not have planned firmware patches, recommended mitigations focus on restricting physical and network access, isolating trusted control segments, and ensuring affected devices remain on secure, trusted networks.