CISA 2026-10-27

Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Machine-generated analysis · WAYSCloud LLM

Multiple Mitsubishi Electric industrial software products, including GENESIS64 and ICONICS Suite, are vulnerable in versions up to 10.97.3. The listed CVEs could enable code execution, authentication bypass, or denial-of-service.

Context

The advisory lists Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz as affected. Vulnerabilities (CVE-2023-4863, CVE-2026-16436-16438) could allow arbitrary code execution, authentication bypass, arbitrary operations, information disclosure, tampering, deletion, or denial-of-service. The advisory notes the products are deployed worldwide and are used in the manufacturing sector.

Operator considerations

Check: Verify installed versions of the listed Mitsubishi Electric products against the affected version ranges.
Isolate: Segment or restrict network access to vulnerable components where possible.
Log: Monitor for suspicious activity such as unexpected code execution or authentication failures related to these products.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system.

The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz are affected:

Mitsubishi Electric GENESIS64 >=10.97|=10.97|

Read the full advisory on CISA →