Critical Auth‑Bypass and RCE Flaws Discovered in Mitsubishi Electric GENESIS & ICONICS Suite (CVE‑2023‑4863, CVE‑2026‑16436‑16438)
What It Is — CISA’s latest advisory (ICS‑A‑26‑300‑02) details four vulnerabilities affecting multiple Mitsubishi Electric industrial‑control software families, including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz.
- CVE‑2023‑4863 enables remote arbitrary‑code execution.
- CVE‑2026‑16436 and CVE‑2026‑16437 bypass authentication, granting unauthenticated access to system functions.
- CVE‑2026‑16438 permits arbitrary operations that can lead to data disclosure, tampering, deletion, or denial‑of‑service.
All listed versions up to the indicated release numbers are vulnerable. No public patches have been released for the affected releases at the time of the advisory; mitigation guidance advises immediate upgrade to patched versions once available and temporary network segmentation.
Affected Products
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz (specific version ranges noted in the advisory).
Why It Matters for Trust & Control Assurance — The authentication bypass directly challenges the access‑control control objective that underpins many frameworks (e.g., NIST CSF 2.0 Protect‑PR.AC). Demonstrating robust identity‑management and continuous monitoring of privileged access is essential to maintain audit‑ready evidence.
Recommended Actions
- Verify product versions against the advisory list and apply vendor‑provided patches or upgrade to a non‑vulnerable release.
- Isolate affected systems from external networks until remediation is complete.
- Conduct a focused vulnerability scan of all Mitsubishi Electric components in your environment.
- Review and tighten access‑control policies; enforce multi‑factor authentication for any remote access paths.
- Update incident‑response playbooks to include detection of unauthorized command execution on these platforms.
Source: CISA Industrial Control Systems Advisory ICS‑A‑26‑300‑02