Zero Radar
← feed
CriticalVulnerabilityCVE-2026-16438updated 27 Oct 2026, 16:19 UTC

Mitsubishi Electric ICONICS/GENESIS64 industrial software: privilege assignment flaw

Industrial control software from Mitsubishi Electric has a flaw that lets someone who already holds an administrator login do more than they should, including running programs that normally need extra approval. This could let them read, cha

Partial fixOfficial, 2 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyGENESIS64 and ICONICS Suite 10.97.3 or later (vendor fix, per CISA); fixed versions for other products not stated in the material · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Admin account holderHas a legitimate administrator login
  2. 2Remote or local accessLogs in to the affected product
  3. 3Launch DCOM objectsDefault permissions skip UAC elevation
  4. 4Control systemCan read, change, or disrupt data
  5. ResultData tampered or system disrupted

What happened

Incorrect privilege assignment (CWE-269 class) in Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64: installers grant default DCOM permissions to the administrator account, so administrators can launch and operate DCOM objects that should require UAC elevation, locally or remotely.

Why it is dangerous: An attacker who obtains an administrator account for these products, or an insider, could disclose, tamper with, destroy or delete data or cause denial of service on critical manufacturing systems.

Are you affected?

You are affected if you run GENESIS64 or ICONICS Suite 10.97.3 or earlier, Hyper Historian, AnalytiX, MobileHMI 10.97.3 or earlier, or any version of MC Works64 (per the GitHub advisory).

GENESIS64 <=10.97.3; ICONICS Suite <=10.97.3; Hyper Historian <=10.97.3; AnalytiX <=10.97.3; MobileHMI <=10.97.3; MC Works64 all versions

What to do

  1. Install GENESIS64 or ICONICS Suite 10.97.3 or later from the Mitsubishi Electric/ICONICS download page
  2. Check the vendor advisory for fixed versions of Hyper Historian, AnalytiX, MobileHMI and MC Works64
  3. Limit administrator accounts on these systems to the minimum needed and restrict remote access to them

Timeline

  1. 15 Oct 2026, 09:30 UTC
    Publicly disclosed
  2. 27 Oct 2026, 12:00 UTC
    Reported by CISA · CISA
  3. 27 Oct 2026, 16:10 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 16:19 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-16438 · GHSA-qcw9-8pcc-76g9
CVSS
9.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
15 Oct 2026, 09:30 UTC
On Zero Radar
27 Oct 2026, 16:10 UTC (12 days after disclosure)
Last change
27 Oct 2026, 16:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Mitsubishi Electric ICONICS/GENESIS64 industrial software: privilege assignment flaw · Zero Radar