CVE-2026-16436An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Updated under an hour ago ()
Does this affect you?
It affects Mitsubishi Electric Corporation GENESIS and 18 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.29%, higher than 20% of scored CVEs.
Do this next
Free account, 1 product
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
- CVSS
- 9.2 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-640
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.29% (percentile 20)
- Assigned by
- Mitsubishi
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Mitsubishi Electric Corporation GENESIS mitsubishi_electric:genesis (from the name) | versions 11.03 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions GENESIS mitsubishi_electric_iconics_digital_solutions:genesis (from the name) | versions 11.03 and prior | CNA record |
Mitsubishi Electric Corporation GENESIS64 mitsubishi_electric:genesis64 (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions GENESIS64 mitsubishi_electric_iconics_digital_solutions:genesis64 (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation ICONICS Suite mitsubishi_electric:iconics_suite (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite mitsubishi_electric_iconics_digital_solutions:iconics_suite (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation Hyper Historian mitsubishi_electric:hyper_historian (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions Hyper Historian mitsubishi_electric_iconics_digital_solutions:hyper_historian (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation AnalytiX mitsubishi_electric:analytix (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions AnalytiX mitsubishi_electric_iconics_digital_solutions:analytix (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation MobileHMI mitsubishi_electric:mobilehmi (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions MobileHMI mitsubishi_electric_iconics_digital_solutions:mobilehmi (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation IoTWorX mitsubishi_electric:iotworx (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions IoTWorX mitsubishi_electric_iconics_digital_solutions:iotworx (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation MC Works64 mitsubishi_electric:mc_works64 (from the name) | all versions | CNA record |
Mitsubishi Electric Corporation GENESIS32 mitsubishi_electric:genesis32 (from the name) | all versions | CNA record |
Mitsubishi Electric Iconics Digital Solutions GENESIS32 mitsubishi_electric_iconics_digital_solutions:genesis32 (from the name) | all versions | CNA record |
Mitsubishi Electric Corporation BizViz mitsubishi_electric:bizviz (from the name) | all versions | CNA record |
Mitsubishi Electric Iconics Digital Solutions BizViz mitsubishi_electric_iconics_digital_solutions:bizviz (from the name) | all versions | CNA record |
References
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdfvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.