Mitsubishi Electric has disclosed four vulnerabilities across its ICONICS industrial software line, and the most striking is a design flaw: the challenge response used to unlock a system is, in the company's words, "common to all users and fixed." Anyone who obtains it can unlock an affected installation. The issues touch GENESIS, GENESIS64, the ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz, according to a CISA advisory published October 27 and Mitsubishi Electric's own security advisory.
These are the visualization, historian and monitoring tools operators use to watch and run industrial processes. CISA lists them as deployed worldwide in the critical manufacturing sector. Mitsubishi Electric found the flaws itself, and three older products will never get a fix.
One unlock code shared by every user
CVE-2026-16436 is a weak password recovery mechanism. It could let a remote attacker unlock the system "by obtaining the challenge response by some means," and because that response is fixed and identical for every user, the advisory gives no reason to think a leaked value would stop working. It scores 8.1 under CVSS 3.1 and 9.2 under CVSS 4.0. A companion bug, CVE-2026-16437 (6.4 under CVSS 3.1, 7.1 under 4.0), lets a local user who already holds administrator rights unlock the system by tampering with the management file that stores the challenge response.
The highest-scored issue is CVE-2026-16438, rated 9.1 under CVSS 3.1 and 9.4 under 4.0. The products' installers unnecessarily grant default DCOM permissions to the products' administrator account, so an attacker who can log in with that same account could launch and operate DCOM objects locally or remotely. The fourth, CVE-2023-4863, is the libwebp heap overflow bundled inside GENESIS64 and the ICONICS Suite, scored 8.2 under CVSS 3.1. That bug has sat on CISA's exploited list since September 2023, but in these products, Mitsubishi says, exploiting it requires an authenticated local administrator to import a crafted file.
For each flaw, Mitsubishi says the outcome could be disclosure, tampering, destruction or deletion of information, or a denial-of-service condition. The CISA advisory does not report any exploitation of the new issues.
Upgrade to 10.98 or GENESIS 11.04, or replace
- GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: Mitsubishi lists version 10.98 or later as the fix for the newer flaws, and 10.97.3 or later for the libwebp bug.
- GENESIS: version 11.04 or later.
- IoTWorX: version 10.98 or later, distributed through the vendor's Docker Hub image.
- MC Works64, GENESIS32 and BizViz: no fix is planned. Mitsubishi recommends its listed mitigations or migrating to GENESIS64 or GENESIS.
Where patching has to wait, Mitsubishi's workaround for the shared unlock code is specific: delete the challenge file (ClientChallengeTable.dat on version 10, SecurityChallenges.dat on version 11), create an empty file with the same name in the same place, and restrict write and delete rights on it to a dedicated administrator account that is separate from the GENESIS administrator. The company also advises letting only administrators log in to the hosts, blocking remote logins from untrusted networks, and keeping the systems behind a firewall or VPN.
It is the second Mitsubishi password weakness we have covered this autumn, after GX Works3 accepted a wrong password. For plants still running GENESIS32 or MC Works64, this advisory reads less like a patch note than a migration notice.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.