Mitsubishi Electric Patches Four Critical ICONICS Suite Vulnerabilities

TL;DR

Mitsubishi Electric released a security advisory on October 15, 2026, addressing four critical and high-severity ICONICS Suite vulnerabilities. These flaws allow attackers to bypass authentication, execute arbitrary code, and manipulate system operations across industrial automation software. Consequently, operators must apply the latest software updates or configure workarounds immediately.

Why It Matters

Industrial organizations worldwide use Mitsubishi Electric SCADA and visualization software, such as GENESIS64 and ICONICS Suite, to monitor critical operations. However, exact global installation counts are not confirmed in the vendor advisory.

According to the official Mitsubishi Electric security advisory, successful exploitation can cause severe operational disruption. Specifically, attackers can steal, alter, or delete internal information and trigger a system denial-of-service condition. Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed for the newly disclosed flaws.

How the Attack Works

The four ICONICS Suite vulnerabilities stem from distinct flaws in privilege management, password recovery, and third-party library parsing.

Privilege Escalation and Code Execution

First, CVE-2026-16438 carries a critical CVSS v4.0 base score of 9.4 and stems from incorrect privilege assignment (CWE-266). During installation, the software grants unnecessary default DCOM permissions to the product administrator account. Therefore, an attacker with access to that account can locally or remotely launch DCOM objects that normally require User Account Control (UAC) elevation.

Next, CVE-2023-4863 (CVSS 9.3) involves an out-of-bounds write flaw (CWE-787) within the internal libwebp component. A local attacker logged in as a product administrator can import a specially crafted file to trigger a heap-based buffer overflow and execute arbitrary code.

Authentication Bypass Flaws

Meanwhile, CVE-2026-16436 (CVSS 9.2) and CVE-2026-16437 (CVSS 7.1) exploit weak password recovery mechanisms (CWE-640) in the security challenge feature. For CVE-2026-16436, the challenge response used to unlock the system is fixed and shared across all users. Thus, any remote attacker who obtains this static response can unlock the system. For CVE-2026-16437, local administrators can directly read and modify the Windows management file that stores the challenge response.

Affected Versions

These ICONICS Suite vulnerabilities impact multiple software lines. CVE-2023-4863 affects GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2. Both CVE-2026-16436 and CVE-2026-16437 impact GENESIS version 11.03 and prior, as well as version 10.97.3 and prior of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX. They also affect all versions of MC Works64, GENESIS32, and BizViz. Finally, CVE-2026-16438 affects all versions of MC Works64 alongside version 10.97.3 and prior of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI.

Patch and Mitigation Steps

Mitsubishi Electric resolved CVE-2023-4863 in ICONICS Suite version 10.97.3. Furthermore, the vendor fixed CVE-2026-16436, CVE-2026-16437, and CVE-2026-16438 in ICONICS Suite and IoTWorX version 10.98, plus GENESIS version 11.04.

By contrast, Mitsubishi Electric will not release patches for MC Works64, GENESIS32, or BizViz, and recommends migrating to GENESIS64 or GENESIS. For unpatched systems, administrators should restrict network access via firewalls and VPNs. To mitigate the authentication bypass flaws, operators can replace the ChallengeTable.dat or SecurityChallenges.dat file with a blank file and restrict write permissions.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.