Mitsubishi Electric ICONICS GENESIS64, ICONICS Suite, GENESIS and related SCADA products: authentication bypass and DCOM permission flaws (CVSS 4.0 up to 9.4); fixed in ICONICS Suite 10.98 and GENESIS 11.04, no fix for MC Works64, GENESIS32 or BizViz
Mitsubishi Electric published advisory 2026-006 on 15 October 2026 for multiple vulnerabilities in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz, and CISA republished it on 27 October as ICS advisory ICSA-26-300-02 (Mitsubishi Electric's advisory, as republished by CISA).
According to Mitsubishi Electric, CVE-2026-16436 (CVSS 4.0 9.2) is an authentication bypass because the challenge response used to unlock the system in the security challenge feature is common to all users and fixed, so a remote attacker who obtains it may be able to unlock the system; CVE-2026-16437 (7.1) lets a local administrator unlock the system by tampering with the management file that stores the challenge response; CVE-2026-16438 (9.4) arises because the installers unnecessarily grant default DCOM permissions to the products' administrator account, so users with that account can locally or remotely launch and operate DCOM objects that should require UAC elevation; and CVE-2023-4863 (9.3), in the bundled libwebp component of GENESIS64 and ICONICS Suite 10.97 to 10.97.2, lets an attacker logged in locally execute arbitrary code by importing a crafted file as an administrator.
Mitsubishi Electric says exploitation could result in information disclosure, tampering with, destruction or deletion of information, and a denial-of-service condition.
It says there are no plans to release fixed versions of MC Works64, GENESIS32 or BizViz. CISA lists the products as deployed worldwide in critical manufacturing.
Primary: Mitsubishi Electric advisory 2026-006.
- Product
- Mitsubishi Electric (ICONICS) GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
- Versions
- Per Mitsubishi Electric (15 Oct 2026): CVE-2026-16436 and CVE-2026-16437 affect GENESIS Version 11.03 and prior; GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX Version 10.97.3 and prior; MC Works64, GENESIS32 and BizViz all versions. CVE-2026-16438 affects GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI Version 10.97.3 and prior and MC Works64 all versions. CVE-2023-4863 affects GENESIS64 and ICONICS Suite Version 10.97 to 10.97.2. Fixed: ICONICS Suite Version 10.98 or later (GENESIS64, Hyper Historian, AnalytiX and MobileHMI are included in the ICONICS Suite installation); IoTWorX 10.98 or later; GENESIS Version 11.04 or later; CVE-2023-4863 fixed in ICONICS Suite Version 10.97.3 or later. No fixed version planned for MC Works64, GENESIS32 or BizViz.
- CVSS
- (CVSS 4.0, Mitsubishi Electric, CVE-2026-16438); 9.3 (CVE-2023-4863); 9.2 (CVE-2026-16436); 7.1 (CVE-2026-16437)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (CVE-2026-16438) - Exploited in Australia?
- unknown
- Patch to
- Install ICONICS Suite Version 10.98 or later (covers GENESIS64, Hyper Historian, AnalytiX and MobileHMI), IoTWorX 10.98 or later, or GENESIS Version 11.04 or later. MC Works64, GENESIS32 and BizViz will not be fixed: Mitsubishi Electric recommends its mitigations or replacing them with GENESIS64 or GENESIS. Mitigations per Mitsubishi Electric: allow only administrators to log in to the PCs running the products; keep them on the LAN and block remote login from untrusted networks, hosts and non-administrator users; use a firewall or VPN and allow remote login only to administrators when internet access is required; restrict physical access; do not open links or attachments in untrusted emails; install anti-virus software; and for CVE-2026-16436/16437 replace the challenge file (ClientChallengeTable.dat in version 10, SecurityChallenges.dat in version 11) with a blank file of the same name and restrict write and delete access to a separate administrator account.
- Primary: Mitsubishi Electric — Multiple vulnerabilities in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz (advisory 2026-006, 15 Oct 2026)
- Vendor: Mitsubishi Electric PSIRT advisory 2026-006 (PDF)
- CVE: CVE-2026-16436, CVE-2026-16437, CVE-2026-16438, CVE-2023-4863
- Source: CISA ICS advisory ICSA-26-300-02 — Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz (republished 27 Oct 2026)