Executive Summary
In June 2026, Mitsubishi Electric disclosed multiple vulnerabilities in its MELSOFT Update Manager SW1DND-UDM-M software, specifically versions 1.000A through 1.014Q. These vulnerabilities, identified as CVE-2025-53816, CVE-2025-53817, CVE-2025-55188, and CVE-2025-11001, stem from issues within the bundled 7-Zip component. Exploitation could allow local attackers to execute arbitrary code, cause denial-of-service conditions, or tamper with information by convincing users to decompress specially crafted archive files. The affected software is widely used in critical manufacturing sectors globally. (knutmichael.com)
The disclosure underscores the persistent risks associated with third-party components in industrial control systems. Organizations are urged to promptly update to version 1.015R or later and implement recommended security measures to mitigate potential threats. (knutmichael.com)
Why This Matters Now
The vulnerabilities in MELSOFT Update Manager highlight the critical need for timely software updates and vigilance against third-party component risks in industrial control systems, especially given their deployment in critical manufacturing sectors worldwide.
Attack Path Analysis
An attacker convinces a user to decompress a malicious archive using MELSOFT Update Manager, exploiting vulnerabilities in the 7-Zip component to execute arbitrary code. This leads to privilege escalation, lateral movement within the network, establishment of command and control channels, data exfiltration, and potential system impact.
Kill Chain Progression
Initial Compromise
Description
An attacker convinces a user to decompress a specially crafted archive file using MELSOFT Update Manager, exploiting vulnerabilities in the 7-Zip component to execute arbitrary code.
Related CVEs
CVE-2025-53816
CVSS 7.5A heap-based buffer overflow vulnerability in the 7-Zip component of MELSOFT Update Manager allows a local attacker to cause a denial-of-service condition by convincing a user to decompress a specially crafted archive file.
Affected Products:
Mitsubishi Electric MELSOFT Update Manager – 1.000A to 1.014Q
Exploit Status:
no public exploitCVE-2025-53817
CVSS 7.5A NULL pointer dereference vulnerability in the 7-Zip component of MELSOFT Update Manager allows a local attacker to cause a denial-of-service condition by convincing a user to decompress a specially crafted archive file.
Affected Products:
Mitsubishi Electric MELSOFT Update Manager – 1.000A to 1.014Q
Exploit Status:
no public exploitCVE-2025-55188
CVSS 3.6An improper link resolution vulnerability in the 7-Zip component of MELSOFT Update Manager allows a local attacker to tamper with or destroy information by convincing a user to decompress a specially crafted archive file.
Affected Products:
Mitsubishi Electric MELSOFT Update Manager – 1.000A to 1.014Q
Exploit Status:
no public exploitCVE-2025-11001
CVSS 7.8A path traversal vulnerability in the 7-Zip component of MELSOFT Update Manager allows a local attacker to execute arbitrary code by decompressing a specially crafted archive file.
Affected Products:
Mitsubishi Electric MELSOFT Update Manager – 1.000A to 1.014Q
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Path Interception by PATH Environment Variable
Path Interception by Search Order Hijacking
Path Interception by Unquoted Path
Dynamic Linker Hijacking
DLL
Dylib Hijacking
Executable Installer File Permissions Weakness
Services File Permissions Weakness
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-82 – Software Maintenance
Control ID: 3.2.4
PCI DSS 4.0 – System Development and Maintenance
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Industrial Automation
Critical vulnerabilities in Mitsubishi MELSOFT Update Manager expose industrial control systems to arbitrary code execution, data tampering, and operational disruption requiring immediate patching.
Electrical/Electronic Manufacturing
Manufacturing operations using Mitsubishi industrial control systems face denial-of-service risks and potential production line compromises through malicious archive file exploitation vulnerabilities.
Automotive
Automotive manufacturing facilities relying on Mitsubishi industrial control systems are vulnerable to heap buffer overflows and path traversal attacks affecting production continuity.
Oil/Energy/Solar/Greentech
Energy sector operations using affected Mitsubishi systems risk critical infrastructure disruption through local attacks exploiting 7-Zip component vulnerabilities in update management software.
Sources
- Mitsubishi Electric MELSOFT Update Manager SW1DND-UDM-Mhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-181-01Verified
- Multiple Vulnerabilities in the 7-Zip component included in MELSOFT Update Managerhttps://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-004_en.pdfVerified
- CVE-2025-53816 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2025-53816Verified
- CVE-2025-53817 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2025-53817Verified
- CVE-2025-55188 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2025-55188Verified
- CVE-2025-11001 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2025-11001Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the attacker's ability to escalate privileges, move laterally, establish command and control channels, and exfiltrate data, thereby reducing the overall blast radius.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While the initial compromise may still occur, subsequent attacker actions would likely be constrained, limiting their ability to escalate privileges or move laterally.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, limiting their access to sensitive resources.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement would likely be restricted, reducing their ability to compromise additional systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be limited, reducing their capacity to maintain persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be constrained, limiting the amount of data that could be extracted.
The attacker's ability to cause significant operational disruption would likely be limited, reducing the overall impact of the attack.
Impact at a Glance
Affected Business Functions
- Software Update Management
- System Maintenance
Estimated downtime: N/A
Estimated loss: N/A
n/a
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation of known vulnerabilities.
- • Utilize Threat Detection & Anomaly Response systems to identify and respond to suspicious activities.
- • Enforce Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Regularly update and patch software to mitigate known vulnerabilities.
