Mitsubishi Electric: four vulnerabilities in GENESIS64 and ICONICS Suite, and no fix for MC Works64, GENESIS32 and BizViz

Mitsubishi Electric does not plan to release a fix for MC Works64, GENESIS32 and BizViz, and advises users either to apply risk-mitigation measures or to replace them with GENESIS64 or GENESIS. The information is in advisory ICSA-26-300-02 of CISA, the US Cybersecurity and Infrastructure Security Agency, which the agency republished on Tuesday, October 27, 2026.

CISA republished in full Mitsubishi Electric’s bulletin 2026-006, which the company had issued on October 15. It concerns four vulnerabilities with CVE identifiers (Common Vulnerabilities and Exposures, the international catalogue of known flaws), that is, security bugs an attacker can exploit, in GENESIS, MC Works64, GENESIS32, BizViz and IoTWorX, and in the ICONICS Suite with GENESIS64, Hyper Historian, AnalytiX and MobileHMI. This is industrial automation software from ICONICS and Mitsubishi Electric, with supervisory control and data acquisition (SCADA) and human-machine interface (HMI) applications, used to monitor and control industrial processes. CISA places them in the critical manufacturing sector and notes that they are used worldwide.

The four vulnerabilities

The most serious is CVE-2026-16438, scored 9.1 on the CVSS 3.1 scale (Common Vulnerability Scoring System, from 0 to 10) and 9.4 on CVSS 4.0, which is critical. It stems from incorrect privilege assignment (CWE-266): the installers needlessly give default DCOM permissions, the Windows mechanism for operating objects remotely, to the products’ administrator account. Anyone who can log in with that account can operate DCOM objects, locally or remotely, and disclose, alter or delete internal information or cause a denial of service (DoS), meaning the system cannot work. GENESIS64, MobileHMI, Hyper Historian, AnalytiX and the ICONICS Suite up to version 10.97.3 are affected, as is every version of MC Works64.

CVE-2026-16436 and CVE-2026-16437, scored 9.2 and 7.1 (CVSS 4.0) and 8.1 and 6.4 (CVSS 3.1), involve authentication bypass through a weak password-recovery mechanism (CWE-640). In the “security challenge” function, the answer that unlocks the system is the same and fixed for all users, so anyone who obtains it can unlock the system (CVE-2026-16436). In CVE-2026-16437, an administrator logged in locally can read and modify the file holding the answer, which is protected by Windows. GENESIS up to version 11.03, IoTWorX and the ICONICS Suite products up to 10.97.3 are affected, along with every version of MC Works64, GENESIS32 and BizViz.

CVE-2023-4863, scored 9.3 (CVSS 4.0) and 8.2 (CVSS 3.1), is an out-of-bounds memory write (CWE-787) in the libwebp component and affects GENESIS64 and ICONICS Suite 10.97 to 10.97.2. An authenticated local attacker can execute arbitrary code by feeding a specially crafted file as the product’s administrator. It was fixed in ICONICS Suite version 10.97.3.

Fixes and mitigations

For the other vulnerabilities, fixes exist in the ICONICS Suite and its components from version 10.98, in IoTWorX from 10.98 and in GENESIS from 11.04. For those who cannot update immediately, and for users of products with no fix, Mitsubishi Electric recommends allowing only administrators to log in to the computers, using them on a local network behind a firewall, restricting physical access and installing antivirus software. For CVE-2026-16436 and CVE-2026-16437 it additionally recommends, for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, deleting the .dat file with the answers, creating an empty file with the same name and restricting write access to a separate administrator account, different from the GENESIS one.

CISA adds its own standing recommendations: minimise the exposure of control systems on the network so they cannot be reached from the internet, isolate them from business networks and use a VPN for remote access. The agency, which with its “CISA 2030” strategy declares a shift to proactive cyber defence and hardening of US critical infrastructure, has also released new versions of ScubaGear and ScubaGoggles for Microsoft 365 and Google Workspace.