CVE-2026-16438An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
Updated under an hour ago ()
Does this affect you?
It affects Mitsubishi Electric Corporation GENESIS64 and 10 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.23%, higher than 13% of scored CVEs.
Do this next
Free account, 1 product
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
- CVSS
- 9.4 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-266
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.23% (percentile 13)
- Assigned by
- Mitsubishi
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Mitsubishi Electric Corporation GENESIS64 mitsubishi_electric:genesis64 (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions GENESIS64 mitsubishi_electric_iconics_digital_solutions:genesis64 (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation ICONICS Suite mitsubishi_electric:iconics_suite (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite mitsubishi_electric_iconics_digital_solutions:iconics_suite (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation Hyper Historian mitsubishi_electric:hyper_historian (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions Hyper Historian mitsubishi_electric_iconics_digital_solutions:hyper_historian (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation AnalytiX mitsubishi_electric:analytix (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions AnalytiX mitsubishi_electric_iconics_digital_solutions:analytix (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation MobileHMI mitsubishi_electric:mobilehmi (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Iconics Digital Solutions MobileHMI mitsubishi_electric_iconics_digital_solutions:mobilehmi (from the name) | versions 10.97.3 and prior | CNA record |
Mitsubishi Electric Corporation MC Works64 mitsubishi_electric:mc_works64 (from the name) | all versions | CNA record |
References
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdfvendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.