On October 15, 2026, Mitsubishi Electric published security advisory 2026, covering four vulnerabilities across its GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz SCADA and visualization software. The most severe, CVE-2026-16438, carries a CVSS v4.0 base score of 9.4. It stems from an installer that grants default DCOM permissions to the product's administrator account that should never have been granted, letting that account launch and operate DCOM objects that normally require UAC elevation, locally or remotely. 

This is a Mitsubishi Electric vulnerability story in 2026 that needs careful reading. Three of the four CVEs require administrator-level access or knowledge of a fixed unlock value, and the fourth (CVE-2023-4863) is a three-year-old libwebp flaw bundled into older builds. None has been reported as exploited against these products. But the advisory also contains an unusual operational detail: the cleanest fix, ICONICS Suite 10.98, removes the vulnerable Security Challenge feature altogether, and three products (MC Works64, GENESIS32, BizViz) will receive no fix at all. 

Research verified as of October 28, 2026. Primary sources: Mitsubishi Electric advisory 2026-006, CISA advisory ICSA-26-300-02, CVE Program records and ICONICS release documentation. 

Executive summary 

Mitsubishi Electric advisory 2026-006 (October 15, 2026; republished by CISA as ICSA-26-300-02 on October 27) covers four CVEs in ICONICS-family SCADA software: CVE-2023-4863 (libwebp, CVSS v4 9.3), CVE-2026-16436 (fixed challenge response, 9.2), CVE-2026-16437 (writable challenge file, 7.1) and CVE-2026-16438 (excess DCOM permissions, 9.4). Exploitation requires local administrator access, the same administrator account, or possession of a fixed unlock value. No exploitation, public proof-of-concept or threat-actor link has been reported. Fixes exist in ICONICS Suite 10.97.3 and 10.98, IoTWorX 10.98 and GENESIS 11.04; MC Works64, GENESIS32 and BizViz get mitigations only. Defenders should verify installed versions, restrict logins and remote access to affected hosts, apply the vendor's challenge-file workaround and plan the 10.98 upgrade. 

Key findings at a glance 

What happened? 

Advisory 2026-006 is a newly issued vendor advisory with newly assigned CVE identifiers, not an update to an older one and not a report of an attack. According to the Mitsubishi Electric advisory, the four issues are: 

• CVE-2023-4863: an out-of-bounds write (CWE-787) in libwebp, a component embedded in GENESIS64 and ICONICS Suite 10.97 to 10.97.2. Exploitation requires a locally logged-in attacker to import a crafted file as a product administrator. 

  
  

• CVE-2026-16436: a weak password-recovery mechanism (CWE-640). In the products' security challenge feature, the challenge response used to unlock the system is common to all users and fixed, so anyone who obtains it can unlock the system. 

  
  

• CVE-2026-16437: the same weakness class (CWE-640), but local. Administrators can read and write the management file that stores the challenge response. 

  
  

• CVE-2026-16438: incorrect privilege assignment (CWE-266). The installers grant unnecessary default DCOM permissions to the product's administrator account. 

CVE-2026-16437 and CVE-2026-16438 sit in the same advisory, alongside CVE-2026-16436 and CVE-2023-4863. Treating this as a "two-CVE" story would understate the exposure, because CVE-2026-16436 is the only issue in the set scored with no privileges required. 

The CISA ICS advisory is described in its revision history as a verbatim republication of Mitsubishi Electric's advisory, converted from the vendor's CSAF data. It adds no independent technical analysis. 

Vulnerability disclosure timeline 

The discovery, disclosure and republication dates are separate events. The October 27 CISA date is not a new finding. 

Technical breakdown of the vulnerabilities 

CVE-2026-16438: DCOM permissions and UAC 

The advisory says that during installation, the affected products "unnecessarily grant default DCOM permissions" to the product's administrator account, so users of that account can locally or remotely launch and operate DCOM objects that should require UAC elevation. The score reflects a network attack vector, low complexity, high privileges required, and high impact on the vulnerable system and on subsequent systems.

Two points deserve attention. First, a 9.4 with PR:H is high because of the network vector and the subsequent-system impact ratings, not because an unauthenticated attacker can walk in. Second, the advisory does not say which DCOM objects are exposed, which permission entries are changed, or whether the change is scoped to specific application IDs or affects machine-wide defaults. Those details are unknown. Anyone claiming to know the exact exploitation mechanics from public sources is going beyond the evidence. 

The advisory is also ambiguous on "administrator account of the affected products." The CVSS vector and the vendor's mitigations (restrict logins to administrators, block remote login from non-administrators) suggest a Windows account, but the text does not settle whether it means a product-level security account or a Windows local administrator. Asset owners should treat both as in scope until Mitsubishi Electric or ICONICS clarifies. 

CVE-2026-16436 and CVE-2026-16437: the Security Challenge feature 

ICONICS documentation describes Security Challenge as a fail-safe for administrators who forget a password or hit a login failure; in the 10.97 help, the administrator opens a challenge dialog and contacts ICONICS Technical Support with the string shown. The vendor now says the response unlocking the system is fixed and common to all users.

The advisory's wording leaves one question open: "common to all users" could mean all accounts on one installation or the same value across installations. The difference matters. A per-installation constant is a local secret problem; a global constant is a product-wide secret problem. The advisory also states only that an attacker may obtain the response "by some means" and does not describe how that could happen remotely. CVSS v4 encodes this with AT:P (attack requirements present) and PR:N, and the 9.2 score therefore assumes that the attacker already has the value. 

CVE-2026-16437 is the local counterpart: an administrator can read and write the management file that stores the response, which the advisory notes is protected by Windows. In practice this is a control-separation issue. Anyone with Windows administrator rights on the SCADA host can alter the unlock mechanism. 

CVE-2023-4863: a third-party library in a SCADA product 

This is the libwebp heap buffer overflow that was exploited in Chromium in 2023 and added to CISA's Known Exploited Vulnerabilities catalog on September 13, 2023. Some secondary trackers label it "exploited," which can mislead readers of the Mitsubishi advisory. That label refers to the library flaw in browsers, not to any reported attack on GENESIS64 or ICONICS Suite. In these products the issue requires a local logged-in administrator importing a crafted file, and the vendor assigns an AV:L/PR:H vector (9.3 under v4). NVD's older generic scoring is 8.8 under CVSS v3.1, which reflects a different threat model.

Root cause: what went wrong? 

The pattern across the three 2026 CVEs is more instructive than any single score. 

• Secrets by design, not by accident. A recovery mechanism that relies on one fixed response cannot be strong, whoever knows it. The vendor's own fix is removal: the ICONICS 10.98 release notes state that the Security Challenge feature has been removed. 

  
  

• Installer-time privilege decisions. CVE-2026-16438 is created at installation, not by a runtime bug. A permission baseline set once by an installer persists for the life of the host and is rarely revisited by OT teams. 

  
  

• Trust in Windows file protection alone. The challenge file relies on operating-system ACLs, which fall away once an attacker holds local administrator rights. The vendor's mitigation recognizes this by asking for write access to be restricted to a unique administrator account separate from the GENESIS administrator. 

  
  

• Bundled components with their own histories. CVE-2023-4863 shows how a library embedded in an industrial suite inherits a vulnerability years after the upstream fix. 

None of this implies a coding failure that has been demonstrated or exploited. It is an assessment of the documented weakness classes (CWE-640, CWE-266, CWE-787). 

How exploitation could affect industrial environments 

The following is a conceptual, hypothetical sequence, not an observed attack, and it deliberately omits technique detail. 

1. Starting position. An attacker has a foothold on the corporate network or a remote-access path to the SCADA segment and holds, or obtains, credentials for the product administrator account (CVE-2026-16438), or has learned the fixed unlock value (CVE-2026-16436), or already has local administrator rights (CVE-2026-16437, CVE-2023-4863). 

   
   

2. Reach. Network reachability to the SCADA host is required for the remote scenarios. Where it is absent, the remote vector is unusable. 

   
   

3. Action. The attacker uses the weakness to operate the product with more authority than intended, or to bypass the product's own login layer. 

   
   

4. Impact. The vendor lists information disclosure, tampering, destruction or deletion of information, and denial of service as potential outcomes. 

Editorial mapping to MITRE ATT&CK for ICS (verify technique IDs before publication): Valid Accounts (T0859) and Remote Services (T0886) for the access step; Data from Information Repositories (T0811) for historian or configuration data; Manipulation of View (T0832) and Modify Parameter (T0836) for tampering scenarios; Denial of Service (T0814) for availability impact. These mappings are analytical interpretations of the vendor's impact statements, not observed adversary behavior. 

Affected products and versions 

Product roles are general descriptions for orientation; the advisory does not define them. 

Note two scoping details that secondary coverage tends to blur. CVE-2026-16438 does not list GENESIS 11, IoTWorX, GENESIS32 or BizViz. And MC Works64 is affected by all three 2026 CVEs with no fix planned. 

How to check your version 

Per the vendor, on Windows 11 open Settings, then Apps, then Apps & features: 

• GENESIS: vulnerable if "ICONICS GENESIS" shows 11.3.578 or prior. 

  
  

• GENESIS64 / ICONICS Suite (CVE-2023-4863): vulnerable if "ICONICS Suite" shows 10.97.020.27 through 10.97.212.46. 

  
  

• GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX (2026 CVEs): vulnerable if "ICONICS Suite" shows 10.97.306.55 or prior. For GENESIS64, MobileHMI, Hyper Historian and AnalytiX, check the Suite entry because they ship in that installer. 

Potential impacts on SCADA and industrial operations 

All of the following are potential consequences described by the vendor or derived from the affected function, not confirmed incidents. Real-world impact depends heavily on architecture. 

• SCADA monitoring and HMI operations: unauthorized operation of the product could alter views, screens or configuration, affecting what operators see. Integrity of the view is a safety-adjacent concern where operators rely on it for decisions. 

  
  

• Historian integrity: for Hyper Historian deployments, tampering or deletion would affect trends, alarm and event records and downstream reporting, with consequences for investigations and regulatory records. 

  
  

• Availability: the vendor lists denial of service. On a single SCADA server that could mean loss of visibility rather than loss of control, because many process controllers run independently of the HMI layer. That distinction is deployment-specific. 

  
  

• Remote operations and plant network access: an administrator-level foothold on a SCADA host is a strong pivot point toward controllers and engineering workstations. 

  
  

• Safety-related monitoring: where alarm presentation or safety-adjacent supervision runs through the same stack, loss of integrity matters more. Safety instrumented systems are normally separate, but that should be verified rather than assumed. 

A vulnerable host is not the same as an exploitable deployment. A GENESIS64 server with no remote administrator logon path, a unique non-shared administrator account, host firewalling and no inbound access from corporate networks presents a very different risk from a flat network with shared administrator credentials and third-party remote access. 

Has exploitation been confirmed? 

No. In the sources reviewed, neither the vendor, CISA nor secondary coverage reports exploitation of CVE-2026-16436, CVE-2026-16437 or CVE-2026-16438. Secondary coverage from Daily Security Review and SecurityOnline states there is no public proof-of-concept. A third-party tracker reports CVE-2026-16438 is not in CISA's KEV catalog; an independent KEV check on the other CVEs should be part of any internal review. Public EPSS estimates for the new CVEs were well under 1% at the time of research. 

No threat actor, campaign, victim, outage or financial loss has been publicly linked to these vulnerabilities. The researchers or organizations who reported them are not named in the vendor advisory text or CVE records reviewed; the CVE record lists discovery as unknown. 

What remains uncertain: how an attacker would obtain the fixed challenge response, which DCOM objects are exposed, whether exploit code exists privately, and how many installations run vulnerable builds.

Why the vulnerabilities matter for CISOs and OT security teams 

The headline scores are less important than three structural facts. 

First, "10.97.3 and prior" keeps recurring. Several 2026 disclosures for this product family, including the SQL credential storage issues in Mitsubishi advisory 2025-023 and other 2026 entries in vulnerability feeds, share that same upper bound. Patching one CVE at a time on 10.97.x is a treadmill; the vendor's 10.98 line is where fixes have been consolidating. That is an observation about disclosure patterns, not a prediction. 

Second, the fix is an upgrade, not a hotfix. The 10.98 release notes describe an all-new installer, removal of the Security Challenge feature and exclusion of the OPC Local Discovery Server from installation. Each is a change that can affect deployments, recovery procedures and integrations. That makes 10.98 a project requiring testing, maintenance windows, backups and engineering sign-off. 

Third, the end-of-support products carry permanent exposure. MC Works64, GENESIS32 and BizViz will not be patched. Their risk can only be reduced through compensating controls or migration, and the vendor's migration document is Japanese-only and behind a membership login. 

Detection and exposure assessment 

Do not run indiscriminate scans against SCADA hosts. Start with passive and records-based work. 

1. Inventory from records first. Use asset management, CMDB, engineering documentation and vendor license records to list hosts running ICONICS-family products, then confirm versions using the vendor's procedure above, during planned access. 

   
   

2. Map reachability. For each host, document which networks and accounts can reach it, including remote desktop, VPN and third-party engineering access, and whether the same administrator account is reused across hosts. 

   
   

3. Check the challenge file. Confirm whether ClientChallengeTable.dat (version 10) or SecurityChallenges.dat (version 11) exists and who holds write access, using read-only review. Note that secondary articles abbreviate the first filename; use the vendor's exact names and locations. 

   
   

4. Use existing telemetry. Standard Windows logs offer defensive visibility without product-specific IOCs: successful and failed logons and special-privilege logons (Security log), process creation, file-access auditing on the challenge file if a SACL is in place, and Distributed COM activity and permission errors in the System log. Verify event IDs against your Windows build before building detections. 

   
   

5. Watch administrator behavior. Interactive administrator logons to SCADA hosts from unexpected sources, and administrator account use outside maintenance windows, are the most relevant signals for the CVE-2026-16438 and CVE-2026-16436 scenarios. 

No indicators of compromise, YARA or Sigma rules have been published for these vulnerabilities in the sources reviewed, and none are offered here.

Remediation and mitigation 

Vendor-recommended actions 

For all four vulnerabilities, Mitsubishi Electric recommends that organizations:

• configure affected PCs so only an administrator can log in; 

  
  

• operate them on a LAN and block remote login from untrusted networks, hosts and non-administrator users; 

  
  

• use firewalls and VPNs, allowing remote login only for administrators when internet access is required; 

  
  

• restrict physical access to the PC and its network; 

  
  

• avoid links and attachments from untrusted email. 

Additional vendor mitigations: install antivirus software on affected PCs (all CVEs; for CVE-2026-16438 also on PCs that can access the host); and for CVE-2026-16436 and CVE-2026-16437, delete the .dat challenge file, create a blank file with the same name and location, and restrict write and delete access to a unique administrator account different from the GENESIS administrator account. Locations per the advisory: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat for version 10 and C:\ProgramData\ICONICS\11\SecurityChallenges.dat for version 11. 

An operational caution, labeled as editorial analysis: because Security Challenge is the product's lost-password recovery route, neutralizing the file may change how an administrator regains access. Confirm a documented recovery path before making the change, and consult the "Safeguarding Security Server Access" guidance referenced in the 10.98 notes. 

Prioritized response plan

Avoid emergency reboots, automatic patch deployment and aggressive testing on production SCADA servers. Use vendor-supported procedures, maintenance windows and engineering approval. 

OT security checklist 

• [ ] All ICONICS-family hosts identified and versions confirmed 

• [ ] Hosts classified: fixable, upgrade planned, or no-fix product 

• [ ] Remote login limited to named administrators 

• [ ] No shared administrator account across SCADA hosts 

• [ ] Challenge-file workaround tested and recovery path documented 

• [ ] SCADA hosts not reachable from general corporate networks 

• [ ] Third-party and vendor remote access inventoried and controlled 

• [ ] Logon and file-access auditing enabled on SCADA hosts 

• [ ] Backups and rollback verified 

• [ ] 10.98 / 11.04 upgrade scheduled with acceptance tests 

Lessons for industrial cybersecurity 

Treat installer behavior as part of the attack surface. Permission baselines set at installation deserve review during onboarding and after upgrades. 

Separate administrative duties on SCADA hosts. The vendor's own CVE-2026-16437 workaround assigns file control to a unique administrator distinct from the application administrator, which is a small but real separation-of-duties lesson. 

Account for end-of-support software in risk registers. "No fix planned" is a decision for the asset owner, with a documented compensating-control and retirement date. 

Don't over-read a score. A 9.4 that requires high privileges and a 9.2 that depends on a leaked value call for different responses from an unauthenticated network flaw. Exposure analysis should drive prioritization, as this editorial qualitative view illustrates (methodology: exposure of the host, account hygiene, product support status and upgrade readiness; no numeric scoring implied): 

How Shieldworkz can support industrial risk reduction 

The vulnerabilities in advisory 2026-006 turn on who can log in, from where, with which privileges. That makes the work mostly one of visibility and architecture. Shieldworkz offers OT security risk assessment and gap analysis and OT vulnerability assessment and penetration testing to establish which SCADA hosts exist, how they are reachable and where account and segmentation weaknesses sit. Its OT security platform provides asset inventory and monitoring that can help scope SCADA hosts and surface unusual administrator activity, and its OT incident response retainer is relevant for teams that want support ready if suspicious activity is found. Version confirmation on the host itself still follows the vendor's procedure, and no tool replaces the vendor's fixes. 

Assess your industrial exposure with Shieldworkz. Identify vulnerable OT assets, prioritize remediation and strengthen your industrial cybersecurity posture: request an assessment.

Frequently asked questions 

What is the Mitsubishi Electric GENESIS64 vulnerability in 2026?  

It is a set of four vulnerabilities in advisory 2026-006, published October 15, 2026, affecting GENESIS64, ICONICS Suite and related products. They involve a libwebp memory flaw (CVE-2023-4863), a fixed unlock value (CVE-2026-16436), a writable challenge file (CVE-2026-16437) and excess DCOM permissions (CVE-2026-16438). 

Which ICONICS versions are affected?  

For the three 2026 CVEs, ICONICS Suite, GENESIS64, Hyper Historian, AnalytiX, MobileHMI and IoTWorX 10.97.3 and prior, GENESIS 11.03 and prior, and all versions of MC Works64, GENESIS32 and BizViz (scope varies by CVE). CVE-2023-4863 affects GENESIS64 and ICONICS Suite 10.97 to 10.97.2. 

What is CVE-2026-16438?  

An incorrect privilege assignment (CWE-266) in which installers grant default DCOM permissions to the product administrator account, allowing local or remote launch and operation of DCOM objects that should require UAC elevation. CVSS v4.0 base score 9.4. 

Is the vulnerability remotely exploitable?  

CVE-2026-16436 and CVE-2026-16438 have network attack vectors in their vendor scores, but both have conditions: knowledge of the fixed challenge response for the former, and administrator-account access for the latter. CVE-2026-16437 and CVE-2023-4863 are local. 

Does exploitation require administrator credentials?  

For CVE-2026-16438, CVE-2026-16437 and CVE-2023-4863, yes, high privileges are required in the vendor's scoring. CVE-2026-16436 requires no privileges but depends on obtaining the fixed challenge response, and the advisory does not say how an attacker would do that. 

Has the vulnerability been exploited in the wild?  

No exploitation of these products has been reported in the sources reviewed. CVE-2023-4863 was exploited in Chromium in 2023, but that does not describe attacks on ICONICS products. 

What can Hyper Historian administrators do to reduce exposure?  

Confirm the "ICONICS Suite" version, limit logons and remote login to named administrators, keep the host off general corporate networks, apply the challenge-file workaround after testing, and plan the move to Suite 10.98. 

Which Mitsubishi Electric updates or mitigations are available?  

Suite 10.97.3 (CVE-2023-4863); Suite and IoTWorX 10.98 and GENESIS 11.04 (the three 2026 CVEs). MC Works64, GENESIS32 and BizViz have mitigations only, with migration to GENESIS64 or GENESIS suggested. 

Final assessment 

The most useful reading of advisory 2026-006 is not "four critical flaws" but "three questions about access and one about lifecycle." Who can log in to your SCADA hosts, and with how many shared credentials? Who can reach them across the network? And which of your installations run products the vendor will never patch? 

Organizations running ICONICS Suite 10.97.x should treat the move to 10.98 as a planned engineering project, started now, rather than waiting for the next 10.97.3-era advisory. Those still on MC Works64, GENESIS32 or BizViz need a written decision, not an assumption. The evidence available today shows no exploitation and several conditions that limit it. That is a reason to work methodically, not a reason to defer.