Zero Radar
← feed
CriticalVulnerabilityCVE-2026-16436updated 27 Oct 2026, 16:19 UTC

Mitsubishi Electric GENESIS and ICONICS products: forgotten-password unlock flaw lets remote attackers in

Industrial control software from Mitsubishi Electric can be unlocked by an attacker who gets a shared, fixed recovery code. Once in, the attacker can read, change, delete data or shut the system down.

Partial fixOfficial, 2 sources
SeverityCriticalCVSS 9.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyGENESIS64 and ICONICS Suite 10.97.3 or later (per vendor, download from the ICONICS product downloads page). No fix is stated in the material for GENESIS32, BizViz, or MC Works64. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerGets the shared fixed challenge response
  2. 2Recovery screenUses the same code for every user
  3. 3System unlockedForgotten-password mechanism bypassed
  4. 4Data at riskRead, changed, deleted or disrupted
  5. ResultAttacker takes control of plant software

What happened

The password recovery mechanism uses a challenge response that is identical and fixed for all users, so a remote attacker who obtains it can unlock the system; related flaws include an authentication bypass and a heap buffer overflow in libwebp (CVE-2023-4863) reachable by an authenticated local admin.

Why it is dangerous: Attackers could disclose, tamper with, destroy or delete internal data, or cause denial of service in plant monitoring and control systems used in critical manufacturing.

Are you affected?

You are affected if you run Mitsubishi Electric GENESIS (11.03 and prior), GENESIS64 or ICONICS Suite (10.97.3 and prior), Hyper Historian, AnalytiX, MobileHMI or IoTWorX (10.97.3 and prior), or any version of MC Works64, GENESIS32 or BizViz.

GENESIS 11.03 and prior; GENESIS64 10.97.3 and prior; ICONICS Suite 10.97.3 and prior; Hyper Historian 10.97.3 and prior; AnalytiX 10.97.3 and prior; MobileHMI 10.97.3 and prior; IoTWorX 10.97.3 and prior; MC Works64, GENESIS32, BizViz: all versions.

What to do

  1. Update GENESIS64 and ICONICS Suite to version 10.97.3 or later from the official ICONICS download page
  2. Check GENESIS, Hyper Historian, AnalytiX, MobileHMI and IoTWorX for vendor updates and apply them
  3. Restrict network access to these systems and isolate them from the internet until patched
  4. Replace or isolate GENESIS32, BizViz and MC Works64, which have no fix listed in the material

Timeline

  1. 15 Oct 2026, 09:30 UTC
    Publicly disclosed
  2. 27 Oct 2026, 12:00 UTC
    Reported by CISA · CISA
  3. 27 Oct 2026, 16:10 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 16:19 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-16436 · GHSA-j5vq-rv93-4ff2
CVSS
9.2 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
15 Oct 2026, 09:30 UTC
On Zero Radar
27 Oct 2026, 16:10 UTC (12 days after disclosure)
Last change
27 Oct 2026, 16:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Mitsubishi Electric GENESIS and ICONICS products: forgotten-password unlock flaw lets remote attackers in · Zero Radar