Mitsubishi GENESIS Vulnerabilities: CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438 Explained

Introduction

Short answer:** CISA’s 27 October 2026 ICS advisory describes vulnerabilities affecting several Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite and related industrial software products. The reported issues include authentication bypass, incorrect privilege assignment and an out-of-bounds write. Operators should identify affected versions, apply the vendor’s fixed releases where available, restrict exposure and review industrial-system change records.

**Key takeaways**

- CISA advisory ICSA-26-300-02 was published on 27 October 2026.

- Affected product families include GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz.

- CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438 can create risks ranging from authentication bypass and privilege abuse to information disclosure, tampering and denial of service.

- GENESIS64 and ICONICS Suite releases in the 10.97 line require careful version checking; CISA lists 10.97.3 or later as a fixed path for the affected 10.97.2-and-earlier range.

- The advisory concerns industrial software risk, not proof that every customer has been compromised.

What did CISA report?

CISA’s ICSA-26-300-02 advisory covers multiple Mitsubishi Electric and ICONICS industrial software products. The advisory says successful exploitation could allow arbitrary operations, information disclosure, data tampering, destruction or deletion, and denial of service. It also lists a CVE-2023-4863 libwebp issue in some GENESIS64 and ICONICS Suite versions, but this article focuses on the three newly highlighted CVE-2026 issues.

The advisory is relevant to industrial operators because these applications can sit close to engineering, monitoring and operational workflows. A vulnerability in an engineering or supervisory workstation does not automatically mean a plant is exposed to the public internet, but it does justify a documented asset and network review.

Which Mitsubishi products may be affected?

CISA identifies affected ranges across GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. For example, GENESIS is listed at versions up to 11.03 for CVE-2026-16436 and CVE-2026-16437, while GENESIS64, ICONICS Suite and several related products are listed through 10.97.3 depending on the CVE.

Do not rely on a product-family name alone. Export the installed-product inventory, exact version, host, business owner and network zone. Match that inventory against the affected-product table in CISA’s advisory and the corresponding Mitsubishi Electric security notice before deciding whether a system is affected.

What are CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438?

CVE-2026-16436 is described as an incorrect privilege-assignment vulnerability. CISA says it may allow an attacker to perform unauthorized actions and affect the confidentiality, integrity or availability of information in affected products.

CVE-2026-16437 concerns a weak password-recovery mechanism. The advisory explains that an administrator-accessible management file stores challenge-response information; tampering with that file could allow the system to be unlocked. This makes administrative access controls, workstation security and file-integrity monitoring especially important.

CVE-2026-16438 is an out-of-bounds write affecting some product families. CISA describes the potential consequences as information disclosure, tampering, destruction or deletion of information, and denial of service. The practical risk depends on the affected product, local privileges, network reachability and the organization’s segmentation.

What should Indian organizations do now?

Start with an asset-led response rather than a broad shutdown. Identify every workstation and server running the affected Mitsubishi or ICONICS software, record exact versions and map each installation to its plant, lab or engineering function. Preserve the inventory so the security team can prove which systems were assessed and when.

Apply the vendor’s fixed version where CISA lists one and where the update has passed the organization’s normal change-control checks. For GENESIS64 and ICONICS Suite, CISA identifies 10.97.3 or later for the affected 10.97.2-and-earlier range. For GENESIS, the advisory identifies 11.04 or later as a fixed version. Product-specific guidance should take precedence when versions differ across components.

Until patching is complete, restrict remote access from untrusted networks, keep industrial workstations in appropriate network zones, limit administrative logins and monitor unexpected changes to management files. Avoid downloading installers from search results, file-sharing sites or unsolicited messages. Use the vendor’s trusted distribution channel and preserve a rollback plan.

How can defenders check for possible compromise?

Review endpoint and application logs for unexpected administrative changes, unusual process launches, new files in application directories, unexplained login activity and changes to system or management files. Compare current configuration with a known-good baseline where one exists.

If suspicious activity is found, follow the organization’s incident-response plan. Isolate a system in a way that does not create unsafe operational consequences, preserve relevant logs and involve qualified responders. Do not repeatedly relaunch software, delete files or reset evidence before the response team has documented the facts.

FAQs

### Is this a confirmed Mitsubishi data breach?

No. CISA’s advisory describes vulnerabilities and possible impacts. It does not establish that every Mitsubishi customer has been compromised or that a particular organization suffered a breach.

### Are these vulnerabilities internet-facing by default?

Not necessarily. Exposure depends on deployment architecture, remote-access paths, segmentation and user privileges. Systems that are not directly internet-facing can still be at risk through compromised engineering workstations or trusted network access.

### Does the CISA advisory apply to every Mitsubishi product?

No. It lists specific product families and affected version ranges. Check the exact product and version against the advisory and the vendor’s security information.

Conclusion

The Mitsubishi GENESIS and related-product issues deserve a disciplined industrial-security response. Inventory exact versions, compare them with CISA’s affected ranges, apply the appropriate vendor fixes, reduce unnecessary remote and administrative access, and monitor for suspicious changes. Treat the advisory as a reason to verify and improve defenses—not as evidence that every installation has already been breached.

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cisa.gov — CISA ICSA-26-300-02
2. cert-in.org.in — CERT-In Vulnerability Notes
3. cve.org — CVE-2026-16436 Record
4. mitsubishielectric.com — Mitsubishi Electric Security Advisories