Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

GENESIS64 and related Iconics products let admin run remote code

CVE-2026-16438 · published 1 day ago
Summary

Versions of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 grant their administrator accounts permission to start system components without required approval. This means anyone who can log in as an administrator could control those components from the local network or remotely, potentially viewing, changing, deleting data, or causing the system to stop working. Update to the latest software releases or restrict administrator rights to prevent this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mitsubishi electric corporation genesis64 versions 10.97.3 and prior
mitsubishi electric iconics digital solutions genesis64 versions 10.97.3 and prior
mitsubishi electric corporation iconics suite versions 10.97.3 and prior
mitsubishi electric iconics digital solutions iconics suite versions 10.97.3 and prior
mitsubishi electric corporation hyper historian versions 10.97.3 and prior
mitsubishi electric iconics digital solutions hyper historian versions 10.97.3 and prior
mitsubishi electric corporation analytix versions 10.97.3 and prior
mitsubishi electric iconics digital solutions analytix versions 10.97.3 and prior
mitsubishi electric corporation mobilehmi versions 10.97.3 and prior
mitsubishi electric iconics digital solutions mobilehmi versions 10.97.3 and prior
mitsubishi electric corporation mc works64 all versions
Original advisory text
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
Timeline
Published15 Oct 2026
Updated16 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-16438 · NVD
CVE-2026-16438 · MITRE
Track software like this
Free during beta