Mitsubishi Electric GENESIS64 flaws incl. CVE-2026-16436 (9.2)

CISA published ICS advisory ICSA-26-300-02 on October 27, 2026, covering four vulnerabilities in Mitsubishi Electric’s GENESIS64 and ICONICS industrial software family. Two are rated critical by NVD (CVE-2026-16436 at 9.2 and CVE-2026-16438 at 9.4), and the advisory also covers CVE-2023-4863, the libwebp heap overflow that is already in CISA’s Known Exploited Vulnerabilities (KEV) catalog.

The advisory does not say that the three new 2026 flaws are being exploited. The older libwebp flaw is exploited, which makes the Mitsubishi Electric GENESIS64 vulnerability set worth prioritising for any site running these products.

What happened

The advisory covers three weakness groups across the GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz products, which CISA lists under the Critical Manufacturing sector, deployed worldwide:

• CVE-2023-4863: an out-of-bounds write (CWE-787) in libwebp, a component bundled inside GENESIS64 and ICONICS Suite. An authenticated local attacker who imports a crafted file as an administrator could trigger a heap buffer overflow and run arbitrary code.
• CVE-2026-16436 and CVE-2026-16437: a weak password recovery mechanism (CWE-640). The challenge response used to unlock the system is common to all users and fixed. A remote attacker who obtains it can unlock the system (CVE-2026-16436). A local administrator can instead tamper with the management file that stores it (CVE-2026-16437).
• CVE-2026-16438: incorrect privilege assignment (CWE-266). The installers grant default DCOM permissions to the product’s administrator account, so a user with that account can launch and operate DCOM objects locally or remotely that should require UAC elevation.

The stated consequences are disclosure, tampering, destruction or deletion of internal information, and denial of service.

Am I affected?

Affected versions listed in the advisory:

• GENESIS64 and ICONICS Suite 10.97 to 10.97.2 (CVE-2023-4863).
• GENESIS 11.03 and earlier (CVE-2026-16436, CVE-2026-16437).
• GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI 10.97.3 and earlier (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438).
• IoTWorX 10.97.3 and earlier (CVE-2026-16436, CVE-2026-16437).
• MC Works64: all versions (all three 2026 CVEs).
• GENESIS32 and BizViz: all versions (CVE-2026-16436, CVE-2026-16437).

Separately, CVE-2023-4863 also affects many browsers and applications outside this vendor’s products, such as Chrome before 116.0.5845.187, but those are not part of this advisory.

Technical details

CVE-2026-16436 scores 9.2 under CVSS 4.0 with a network attack vector, no privileges and no user interaction. CVE-2026-16437 scores 7.1 (local, high privileges required, high complexity). CVE-2026-16438 scores 9.4 with a network vector but requires the administrator account. CISA lists a vendor-equipment CVSS v3 score of 9.1 for the advisory as a whole.

CVE-2023-4863 has an NVD score of 8.8 and an EPSS exploitation probability of 0.99979. It was added to KEV on 2023-09-13 with a due date of 2023-10-04. Its KEV ransomware-use field reads “Unknown”. EPSS for the new flaws is low: 0.00322 (CVE-2026-16436), 0.00093 (CVE-2026-16437) and 0.00253 (CVE-2026-16438).

Why this matters

This section is analysis, not new fact. HMI and SCADA software often sits close to operational networks, and the unlock mechanism in CVE-2026-16436 depends on one fixed value shared by all users. If a site exposes these systems beyond a segmented network, the network-reachable flaws deserve the most attention. The two administrator-gated flaws matter mainly after an attacker already holds an admin foothold, where they widen what that foothold can do.

Is the fix available?

Mitsubishi Electric is releasing version 10.97.3 or later for GENESIS64 and ICONICS Suite to address CVE-2023-4863. The advisory data reviewed lists affected versions for the 2026 flaws up to and including 10.97.3, so 10.97.3 does not by itself appear to resolve them. A fixed version for those three CVEs has not been published in the advisory data available here. Check the vendor’s PSIRT advisory 2026-006 for current remediation and mitigations.

What to do

1. Inventory GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz installs, including legacy ones.
2. Upgrade GENESIS64 and ICONICS Suite to 10.97.3 or later for CVE-2023-4863. Treat this as urgent, since the flaw is in KEV.
3. Follow the vendor PSIRT guidance for CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438, and watch for a newer fixed release.
4. Keep these hosts off the internet and limit access to engineering networks through segmented, access-controlled paths.
5. Restrict and monitor the product administrator accounts and review their DCOM launch permissions.
6. Hunt for unexpected unlock events, edits to the management file that stores the challenge response, remote DCOM activations against these hosts, and crafted image files imported by administrators.

Related coverage

• Palo Alto PAN-OS GlobalProtect flaw exploited by ransomware (CVE-2026-0257)
• Hitachi Energy SOI exposed to ActiveMQ RCE flaw (CVE-2026-34197)
• Rejetto HFS session forgery flaw probed in the wild (CVE-2026-61500)

Sources

• CISA ICS Advisory ICSA-26-300-02
• NVD CVE-2026-16436
• NVD CVE-2023-4863
• Mitsubishi Electric PSIRT 2026-006