Mitsubishi Electric has published an advisory covering four vulnerabilities in its ICONICS Suite industrial software that allow authentication bypass, arbitrary code execution and manipulation of system operations. Fixes exist for current products, but the company will not release patches for MC Works64, GENESIS32 or BizViz.
Four ICONICS Suite Vulnerabilities and Their Scores
The advisory, published October 15, affects ICONICS Suite, GENESIS64, GENESIS, Hyper Historian, AnalytiX, MobileHMI and IoTWorX, along with MC Works64, GENESIS32 and BizViz. There is no public proof-of-concept and no confirmed exploitation. Exact installation counts are not given.
CVE-2026-16438: Default DCOM Permissions Granted to the Administrator Account
CVE-2026-16438 has a CVSS v4 score of 9.4 and is caused by incorrect privilege assignment. The installer grants unnecessary default DCOM permissions to the product administrator account. An attacker holding that account can launch DCOM objects that normally require UAC elevation.
CVE-2023-4863: libwebp Out-of-Bounds Write in GENESIS64
CVE-2023-4863 scores 9.3 and is an out-of-bounds write in libwebp. It affects GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2. A local product administrator who imports a crafted file can run arbitrary code.
CVE-2026-16436 and CVE-2026-16437: A Shared, Fixed Challenge Response
CVE-2026-16436 (CVSS 9.2) stems from the challenge response used to unlock the system being fixed and shared across all users. Any remote attacker who learns the value can unlock the system. The related CVE-2026-16437 (CVSS 7.1) lets local administrators read and modify the file that stores the challenge response.
Impact on Industrial Monitoring Environments
The advisory warns that successful exploitation can let attackers steal, alter or delete data and cause denial of service. Mitsubishi Electric also says the flaws allow authentication bypass, arbitrary code execution and manipulation of system operations, so an attacker who gets in could change how a monitored process behaves, not only read its data. The products affected include GENESIS64, Hyper Historian, AnalytiX and MobileHMI, software used for visualization and data collection in industrial settings. Mitsubishi Electric has not stated how many installations exist, and the advisory lists no affected customers, and it reports no confirmed exploitation, so the advisory describes potential consequences rather than observed ones.
Fixed Versions and the End-of-Line Products
The patch picture is uneven across the product line, with current products receiving fixes and three older products excluded.
The fixes are version-specific. ICONICS Suite 10.97.3 addresses the libwebp flaw. ICONICS Suite and IoTWorX 10.98, along with GENESIS 11.04, address the other three.
MC Works64, GENESIS32 and BizViz: Migrate to GENESIS64 or GENESIS
Mitsubishi Electric will release no patches for MC Works64, GENESIS32 or BizViz. The vendor recommends that customers migrate to GENESIS64 or GENESIS. Operators of the three products remain exposed to the flaws that apply to them, and the migration advice puts the replacement burden on the customer.
The advisory therefore leaves operators of the three end-of-line products with mitigation steps instead of fixes. For systems that cannot be updated, the vendor’s mitigations are to restrict network access with firewalls and VPNs, and to replace ChallengeTable.dat or SecurityChallenges.dat with a blank file while restricting write permissions to it.
Why a Fixed Challenge Value Matters in Industrial Software
CVE-2026-16436 differs from the other three in that it is exploitable remotely and requires only knowledge of a single value. Because the value is shared across all users, learning it once is enough to unlock the system. The advisory does not say how an attacker would learn the value, and there is no report that anyone has.
The inclusion of CVE-2023-4863 shows that third-party libraries bundled into industrial products carry their own vulnerability histories. The libwebp flaw dates to 2023 and appears here because it is embedded in GENESIS64 and ICONICS Suite 10.97 through 10.97.2, where the 10.97.3 release replaces the affected component.
