Critical severity · published Oct 15, 2026
CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
9.2
CVSS
0.3%
EPSS
No
On KEV
Description
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
AnalytiX · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
BI
BizViz · Mitsubishi Electric Iconics Digital Solutions
all versions · source: vendor
GE
GENESIS · Mitsubishi Electric Corporation
versions 11.03 and prior · source: vendor
GE
GENESIS32 · Mitsubishi Electric Iconics Digital Solutions
all versions · source: vendor
GE
GENESIS64 · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
HH
Hyper Historian · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
IS
ICONICS Suite · Mitsubishi Electric Iconics Digital Solutions
versions 10.97.3 and prior · source: vendor
IO
IoTWorX · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
MW
MC Works64 · Mitsubishi Electric Corporation
all versions · source: vendor
MO
MobileHMI · Mitsubishi Electric Corporation
versions 10.97.3 and prior · source: vendor
In the news
VulnerabilityHigh
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system.
The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz are affected:
Mitsubishi Electric GENESIS64 >=10.97|<=10.97.2 (CVE-2023-4863)
Mitsubishi Electric ICONICS Suite >=10.97|<=10.97.2 (CVE-2023-4863)
Mitsubishi Electric GENESIS <=11.03 (CVE-2026-16436, CVE-2026-16437)
Mitsubishi Electric GENESIS64 <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric ICONICS Suite <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric Hyper Historian <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric AnalytiX <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric MobileHMI <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric IoTWorX <=10.97.3 (CVE-2026-16436, CVE-2026-16437)
Mitsubishi Electric MC Works64 vers:all/* (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
Mitsubishi Electric GENESIS32 vers:all/* (CVE-202...
Oct 27, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16436
www.mitsubishielectric.com
https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf
More from AnalytiX
9.4
CVE-2026-16438
An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64
9.3
CVE-2025-14816
Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64
9.3
CVE-2025-14815
Information Disclosure, Tampering, and Denial-of-Service Vulnerabilities in GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, GENESIS, and MC Works64
7.1
CVE-2026-16437
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz