Mitsubishi Electric published advisory 2026-006 on 15 October 2026, covering four vulnerabilities across the ICONICS GENESIS line. If you run GENESIS at Version 11.03 or prior, or GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI or IoTWorX at Version 10.97.3 or prior, or MC Works64, GENESIS32 or BizViz at any version, the advisory is addressed to you. The finding to read first sits in the security challenge feature: the response used to unlock the system "is common to all users and fixed", so "anyone who obtains the challenge response can unlock the system".

If you run GENESIS64 or ICONICS Suite 10.97 to 10.97.2

One of the four, CVE-2023-4863, is listed in CISA's Known Exploited Vulnerabilities catalog, added 13 September 2023 (KEV catalog feed, catalog version 2026.11.04, read 5 November 2026). The entry is filed under Google Chromium WebP and says the flaw "can affect applications that use the WebP Codec"; Mitsubishi names libwebp as an internal component of GENESIS64 and ICONICS Suite, and lists Version 10.97 to 10.97.2 as its only affected versions. No source we opened reports exploitation of ICONICS products. Mitsubishi's steps, in its order: check the version under Settings, Apps, Apps and features, then install the fixed version, ICONICS Suite Version 10.97.3 or later, from the ICONICS product downloads page. For customers keeping the affected product, its stated mitigation for this CVE is anti-virus software on that PC (Mitsubishi Electric, release date 15 October 2026, read 5 November 2026).

A recovery mechanism that recovers for anyone

Both authentication bypasses are classed as CWE-640, weak password recovery for a forgotten password, and sit either side of the same file.

CVE-2026-16436, scored at CVSS v4.0 9.2, is the shared value itself. Because the response is identical across installations, its secrecy is the only control, and secrecy does not survive a screenshot or a support ticket. Mitsubishi's impact line is that "a remote attacker may be able to unlock the system by obtaining the challenge response by some means", and its vector carries an attack requirement, AT:P, so this is not a clean remote hit.

CVE-2026-16437, scored 7.1, is the storage side: administrators "are able to read and write the management file that stores the challenge response", which "is protected by Windows". That value can be read off a host, or rewritten, by anyone holding local administrator rights.

The fourth, CVE-2026-16438 at 9.4, is an installer artefact. The installers "unnecessarily grant default DCOM permissions to the administrator account of the affected products", so users holding that account "can locally or remotely launch and operate DCOM objects that should require UAC elevation". A boundary Windows would otherwise enforce with a prompt was removed at setup.

Three products are affected in all versions

MC Works64, GENESIS32 and BizViz are listed as affected in all versions for CVE-2026-16436 and CVE-2026-16437, and MC Works64 also for CVE-2026-16438. For all three, Mitsubishi says there are "no plans to release a fixed version" and recommends the mitigations, or replacement with GENESIS64 or GENESIS.

The mitigation text repays reading against that product list. The step that removes the shared value, deleting the .dat file and recreating it blank with restricted access, is written for "GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64". GENESIS32 and BizViz are not named in it, and neither is IoTWorX. For those two unfixed products the published remediation is the general list below only.

What this means if you maintain ICONICS servers in a plant

These are supervisory machines: HMI, historian, reporting and mobile access servers. They hold the graphics an operator trusts and the record an engineer uses to judge whether a process behaved. Unlocking one does not move a valve, and nothing in the advisory says it does. It puts an attacker on the console that watches the valve.

The shared response is a constant, not a configuration. Passwords can be rotated; a value fixed by the product across every install cannot, which is why Mitsubishi's workaround replaces the file instead.

Two of the four are gated on holding the product's administrator account, so the question for whoever maintains these servers is which people and which service accounts are mapped to it today, and from where they can log in. Where one account is shared across an estate, the DCOM widening follows it.

What to do if you run ICONICS or GENESIS software

Now

  • For CVE-2023-4863 on GENESIS64 and ICONICS Suite Version 10.97 to 10.97.2, the steps are in the section above.
  • Scope check, per Mitsubishi's own instructions: open Settings, select Apps, then Apps and features. GENESIS is affected if "ICONICS GENESIS" shows 11.3.578 or prior. GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX are affected if "ICONICS Suite" shows 10.97.306.55 or prior, and the libwebp flaw applies where it shows 10.97.020.27 through 10.97.212.46. For GENESIS64, MobileHMI, Hyper Historian and AnalytiX, Mitsubishi says to check the bundled "ICONICS Suite" version (Mitsubishi Electric).
  • Then install the fixed version for each product, from the ICONICS product downloads page: ICONICS Suite Version 10.98 or later, which also covers GENESIS64, Hyper Historian, AnalytiX and MobileHMI as bundled installs; GENESIS Version 11.04 or later; and IoTWorX 10.98 or later, from Docker Hub. ICONICS Suite has two fix lines: 10.97.3 clears CVE-2023-4863, and 10.98 is required for the other three.
  • For MC Works64, GENESIS32 and BizViz, with no fix planned, apply the mitigations below instead.

This week

  • Our recommendation: record, per host, the product, the version string you read, and whether the machine is reachable from outside its LAN. Mitsubishi's mitigations assume LAN-only use and administrator-only logon, so hosts failing those conditions need the rest of the work. Where no such register exists, the asset inventory gap is what to close first.
  • Our recommendation: enumerate who holds the ICONICS administrator account on each machine, including integrator and service accounts. Mitsubishi ties CVE-2026-16437 and CVE-2026-16438 to that account.

Plan

  • For MC Works64, GENESIS32 and BizViz, Mitsubishi's stated alternative to running on mitigations is replacement with GENESIS64 or GENESIS. Its MC Works64 replacement guide is Japanese only and behind a membership login by its own note, so the route left is a Mitsubishi Electric FA representative.
  • Our recommendation: treat hosts that stay on mitigations as monitored rather than fixed. Watching logons and DCOM activity on a supervisory server depends on knowing which zones may talk to it, and segmentation is usually thinner than a diagram suggests.

If you cannot patch

Mitsubishi publishes mitigations for every affected product. For all four: allow only an administrator to log in to the PC; use it on the LAN and block remote logon from untrusted networks and hosts and from non-administrator users; use a firewall or VPN and allow remote logon only to an administrator where internet access is required; restrict physical access to the PC and its network; and do not click links or open attachments in untrusted email. For CVE-2026-16436 and CVE-2026-16437 on GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, three ordered steps follow: delete the .dat file, C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat on Version 10 and C:\ProgramData\ICONICS\11\SecurityChallenges.dat on Version 11; create a blank file with the same name and location; then restrict write and delete access to it to "a unique administrator account, different than the GENESIS administrator account". For CVE-2026-16438 it names LAN-only use behind firewalls, a firewall or VPN where internet access is required, and anti-virus on the host and on any PC that can reach it (Mitsubishi Electric, read 5 November 2026).

If you are not affected

GENESIS at Version 11.04 or later, ICONICS Suite at 10.98 or later and IoTWorX at 10.98 or later sit outside every affected range here, and there may be nothing further to do. CVE-2023-4863 reaches only GENESIS64 and ICONICS Suite at Version 10.97 to 10.97.2, and CVE-2026-16438 is listed only for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, so GENESIS 11, IoTWorX, GENESIS32 and BizViz are out of scope for the DCOM finding. The advisory shows release date 15 October 2026 with no update marker in Mitsubishi's PSIRT feed as of 5 November 2026, so these ranges are current as we read them.

Where part of an estate can only be compensated for and watched, the controls left are knowing which hosts run it and seeing what they do, which our OT security services and managed OT SOC are built around.