The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has republished a Mitsubishi Electric advisory covering four vulnerabilities in GENESIS64 and related ICONICS industrial software, including an authentication bypass and a privilege flaw rated 9.1 out of 10. Mitsubishi Electric has released fixed versions for current products but says it has no plans to patch three older ones, MC Works64, GENESIS32 and BizViz.

CISA posted the advisory, ICSA-26-300-02, on Oct. 27 as a republication of Mitsubishi Electric security advisory 2026-006, which the company released on Oct. 15. CISA updated the vendor and product names on Oct. 29, according to the revision history. The agency lists the affected products as deployed worldwide in the critical manufacturing sector. On its security page, Mitsubishi Electric Iconics Digital Solutions describes GENESIS, GENESIS64 and GENESIS32 as supervisory control and data acquisition (SCADA) products.

The four flaws

According to the advisories, the vulnerabilities are:

  • CVE-2026-16438, an incorrect privilege assignment. During installation, the installers of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64 unnecessarily grant default DCOM permissions to the products’ administrator account, so a user with that account can locally or remotely launch and operate DCOM objects that should require Windows User Account Control (UAC) elevation. It carries a CVSS v3.1 base score of 9.1 and a CVSS v4.0 score of 9.4.
  • CVE-2026-16436, a weak password recovery mechanism. In the products’ security challenge feature, the challenge response used to unlock the system is fixed and common to all users, so anyone who obtains it can unlock the system, including a remote attacker. It scores 8.1 under CVSS v3.1 and 9.2 under v4.0.
  • CVE-2026-16437, a related weakness in which a locally logged-in user with administrator privileges could unlock the system by tampering with the Windows-protected management file that stores the challenge response. It scores 6.4 under v3.1 and 7.1 under v4.0.
  • CVE-2023-4863, an out-of-bounds write in libwebp, an internal component of GENESIS64 and ICONICS Suite versions 10.97 to 10.97.2. An attacker logged in locally could trigger a heap-based buffer overflow and run arbitrary code by importing a crafted file as an administrator. It scores 8.2 under v3.1 and 9.3 under v4.0.

Mitsubishi Electric said successful exploitation could lead to information disclosure, tampering with, destruction or deletion of information, and a denial-of-service condition. The two password recovery flaws affect GENESIS version 11.03 and earlier; GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX version 10.97.3 and earlier; and all versions of MC Works64, GENESIS32 and BizViz. The advisories credit Mitsubishi Electric with discovering the vulnerabilities.

Fixes and workarounds

The libwebp flaw is fixed in ICONICS Suite 10.97.3 or later. The other issues are fixed in ICONICS Suite 10.98 or later, which includes GENESIS64, Hyper Historian, AnalytiX and MobileHMI, in IoTWorX 10.98 or later, and in GENESIS 11.04 or later. For MC Works64, GENESIS32 and BizViz, Mitsubishi Electric recommends applying its mitigations or replacing the software with GENESIS64 or GENESIS.

For systems that cannot be updated right away, the company recommends allowing only administrators to log in to PCs running the software, keeping those PCs on the local network and blocking remote login from untrusted networks, hosts and non-administrator users, and using a firewall or virtual private network (VPN) when internet access is required. It also advises restricting physical access, not opening links or attachments in untrusted emails, and installing antivirus software. For the password recovery flaws, it describes deleting the challenge file, replacing it with a blank file of the same name and limiting write and delete access to a unique administrator account separate from the GENESIS administrator account.

CISA’s standard guidance in the advisory adds that control system devices should not be accessible from the internet, should sit behind firewalls isolated from business networks, and that VPNs used for remote access should be kept up to date.

Why it matters

The affected programs are SCADA products used in critical manufacturing, and the vendor says exploitation could expose, alter or delete information or knock systems offline. Three of the four flaws score 9.0 or higher under CVSS v4.0. The two that can be exploited remotely each still require either the products’ administrator account or knowledge of the shared challenge response, according to the advisories.

The lack of fixes for MC Works64, GENESIS32 and BizViz leaves sites running that software with mitigations or a migration as the only options the vendor offers. Mitsubishi Electric points MC Works64 users to a Japanese-language migration guide for moving to GENESIS64, available to registered members of its factory automation website.

The caveats

CISA notes that the advisory is a verbatim republication of the vendor’s own document and that the agency is not responsible for its editorial or technical accuracy. Neither advisory reports known public exploitation of these vulnerabilities, and neither gives a count of affected installations.