Advisories › Mitsubishi Electric › ICSA-26-300-02
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz: 4 CVEs, Critical 9.1
Summary
CISA reports 4 vulnerabilities in Mitsubishi Electric Mitsubishi Electric GENESIS64, Mitsubishi Electric ICONICS Suite, Mitsubishi Electric GENESIS, Mitsubishi Electric Hyper Historian and 15 more. Weakness types: Out-of-bounds Write, Weak Password Recovery Mechanism for Forgotten Password, Incorrect Privilege Assignment. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or… Highest CVSS v3 score: 9.1 (Critical), exploitable over the network. At least one CVE is on CISA's Known Exploited Vulnerabilities list.
What to do: Act now: Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite.
Why this matters for oil & gas: Mitsubishi Electric PLCs/ICONICS SCADA are used in some oil & gas facilities; Affected products include Historian.
At a glance
- Vendor
- Mitsubishi Electric
- Products
- Mitsubishi Electric GENESIS64, Mitsubishi Electric ICONICS Suite, Mitsubishi Electric GENESIS, Mitsubishi Electric Hyper Historian, Mitsubishi Electric AnalytiX, Mitsubishi Electric MobileHMI, Mitsubishi Electric IoTWorX, Mitsubishi Electric MC Works64
- CVEs
- CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, CVE-2026-16438
- Highest CVSS v3
- 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- Yes
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- Japan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2023-4863 | Out-of-bounds Write | 8.2 | – | Yes (added 2023-09-13) | Out-of-bounds Write (CWE-787) vulnerability caused by libwebp, an internal component in GENESIS64 and ICONICS Suite could allow an authenticated local attacker to cause a heap-based buffer overflow and execute arbitrary code by importing a crafted file as an administrator for the affected product. As a result, the attacker may disclose internal information, tamper with, destroy, or delete internal… |
| CVE-2026-16436 | Weak Password Recovery Mechanism for Forgotten Password | 8.1 | – | No | Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz could allow a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the… |
| CVE-2026-16437 | Weak Password Recovery Mechanism for Forgotten Password | 6.4 | – | No | Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz could allow an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and… |
| CVE-2026-16438 | Incorrect Privilege Assignment | 9.1 | – | No | Incorrect Privilege Assignment (CWE-266) vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 could allow an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions… |
Affected products (23)
- Mitsubishi Electric GENESIS64: >=10.97|<=10.97.2
- Mitsubishi Electric ICONICS Suite: >=10.97|<=10.97.2
- Mitsubishi Electric GENESIS: <=11.03
- Mitsubishi Electric GENESIS64: <=10.97.3
- Mitsubishi Electric ICONICS Suite: <=10.97.3
- Mitsubishi Electric Hyper Historian: <=10.97.3
- Mitsubishi Electric AnalytiX: <=10.97.3
- Mitsubishi Electric MobileHMI: <=10.97.3
- Mitsubishi Electric IoTWorX: <=10.97.3
- Mitsubishi Electric MC Works64: vers:all/*
- Mitsubishi Electric GENESIS32: vers:all/*
- Mitsubishi Electric BizViz: vers:all/*
- Mitsubishi Electric Iconics Digital Solutions GENESIS64: >=10.97|<=10.97.2
- Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: >=10.97|<=10.97.2
- Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03
- Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3
- Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*
- Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64 is included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". link
- Vendor Fix: Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". Note: GENESIS64 is included in the ICONICS Suite installation. For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert". link
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.
- Mitigation: For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.
- Vendor Fix: Mitsubishi Electric is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". link
- Vendor Fix: Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert". link
- Vendor Fix: Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". link
- Vendor Fix: Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://ic link
- Vendor Fix: Mitsubishi Electric is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". link
- Vendor Fix: Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert". link
- No Fix Planned: Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/m link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-300-02
- Machine-readable CSAF record
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.