Mitsubishi Electric GENESIS64/ICONICS Suite: Incorrect privilege assignment in DCOM
Summary
Several Mitsubishi Electric and ICONICS industrial HMI, SCADA and historian products grant default DCOM permissions to their installed administrator account. A user with this administrator login can locally or remotely launch and operate DCOM objects that should require UAC elevation. An attacker with those credentials could disclose, modify or delete data, or cause a denial of service. The CVSS score of 9.4 is from the CNA; NVD had not yet analysed the CVE at the time of research.
Affected
- GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI: version 10.97.3 and prior (Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions naming)
- MC Works64: all versions
Fixed in
- GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI: version 10.98 or later according to CISA ICSA-26-300-02 (to be confirmed against the Mitsubishi advisory)
- MC Works64: unknown, no confirmed fixed version
Workaround
- Review and restrict DCOM permissions for all administrator accounts tied to these products, so only required services keep elevated rights.
- Limit administrator logons on these hosts.
Exploitation
- Not known to be exploited. SSVC: exploitation none, automatable no, technical impact total.
- No CISA KEV listing and no public proof of concept found at the time of research.
- EPSS about 0.2% at last capture.
Our recommendation
- Inventory all hosts running the listed products and their versions.
- Upgrade to the vendor-fixed version (10.98 or later, to be confirmed against the Mitsubishi advisory).
- For MC Works64 and any unpatched host, restrict DCOM rights for administrator accounts and limit admin logons.
- Keep these systems off the internet, check for exposed RDP, VPN or DCOM ports, and monitor for unexpected DCOM activity.
- Patch the whole CISA bundle, including CVE-2026-16436 and CVE-2026-16437.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mitsubishi Electric PSIRT 2026-006 (primary advisory) www.mitsubishielectric.com
- CISA ICSA-26-300-02 www.cisa.gov
- NVD mirror on Vulners vulners.com
- VulDB CVE-2026-16438 vuldb.com
- SecurityOnline: Mitsubishi Electric ICONICS Suite vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:03.
Original description (NVD)
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.