Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

What it is

CISA advisory ICSA-26-300-02 republishes Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions notice 2026-006 for the GENESIS/ICONICS SCADA and HMI family. It lists four CVEs: CVE-2023-4863 (CWE-787 out-of-bounds write, arbitrary code execution), CVE-2026-16436 and CVE-2026-16437 (authentication bypass), and CVE-2026-16438 (arbitrary operations). The stated impact is information disclosure, tampering, destruction or deletion of information, and denial of service. The advisory is tagged Critical Manufacturing, deployed worldwide.

Preconditions / Affected

Which CVEs apply depends on the product, so check the table before choosing a target version.

10.97.3 fixes only the code execution flaw. It is still affected by the three 2026 CVEs, so a site that stops at 10.97.3 stays exposed. Version 10 installations need 10.98.

What to do

Update from the ICONICS product downloads page (iconicsinc.my.site.com/community/s/resource-center/product-downloads). GENESIS64, Hyper Historian, AnalytiX and MobileHMI are included in the ICONICS Suite installer. Vendor detail is in Mitsubishi Electric PSIRT PDF 2026-006_en and the Iconics whitepaper at iconics.com/about/security/cert.

For products with no fix, or where updating must wait, the vendor gives a file-based mitigation for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64. It is listed on the pages for the 2026 CVEs:

1. Delete the challenge file. Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat. Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat.
2. Create a blank file with the same name and location.
3. Restrict write and delete access on that file to a unique administrator account, different from the GENESIS administrator account.

This file mitigation is not listed for GENESIS32 or BizViz, and the advisory text shown does not list it for IoTWorX.

General mitigations, repeated for every product:

• Allow only administrators to log in to the host PC.
• Keep the host on the LAN and block remote login from untrusted networks, hosts and non-administrator users.
• Use a firewall or VPN, with remote login for administrators only.
• Restrict physical access to the PC and its network.
• Avoid links and attachments in untrusted email.
• Install anti-virus software.

MC Works64, GENESIS32 and BizViz: the vendor suggests migrating to GENESIS64 or GENESIS. The MC Works64 migration guide is Japanese only and needs a Mitsubishi Electric FA site login.

Caveats

The fetched text was truncated at 60,000 of 346,740 characters, so the later part of the advisory is not covered. That includes any remaining product entries, CVSS scores and the per-CVE descriptions of the 2026 flaws. The page text gives no exploitation status and no root cause for CVE-2026-16436, -16437 or -16438.