CISA republished a Mitsubishi Electric advisory for the ICONICS GENESIS family on 27 October and revised it on 29 October. The overall score is CVSS 9.1. The most serious flaw lets a remote attacker unlock the system using a challenge-response code that is the same for every user. Other flaws let a local administrator tamper with the challenge-response file and allow unauthorised operations. Some versions also include a known flaw in the libwebp image library. Affected products and IDs CVE-2026-16436 (CVSS v3 8.1, v4 9.2), CVE-2026-16437 and CVE-2026-16438. CVE-2023-4863 (libwebp) affects GENESIS64 and ICONICS Suite 10.97 to 10.97.2; fixed in 10.97.3 or later. Fixed versions: GENESIS 11.03 and earlier, update to 11.04 or later; GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX 10.97.3 and earlier, update to 10.98 or later. No fix is planned for MC Works64, GENESIS32 or BizViz. Exploitation status None known, according to the advisory. Why it matters to OT operators These SCADA and historian products are used for monitoring and control in industrial plants, and some older products will never get a fix. Mitsubishi Electric advises updating where a fix exists, allowing only administrators to log in, blocking remote logins from untrusted networks and using firewalls or a VPN, restricting physical access, and replacing the challenge .dat file with a blank file that only a dedicated admin account can write to (the advisory gives the exact steps). Sources CISA ICSA-26-300-02, Mitsubishi Electric ICONICS GENESIS family, 27 Oct 2026 (revised 29 Oct) Source dates: 27 Oct 2026 (revised 29 Oct).
CISA republished a Mitsubishi Electric advisory for the ICONICS GENESIS family on 27 October and revised it on 29 October. The overall score is CVSS 9.1. The most serious flaw lets a remote attacker unlock the system using a challenge-response code that is the same for every user. Other flaws let a local administrator tamper with the challenge-response file and allow unauthorised operations. Some versions also include a known flaw in the libwebp image library. Affected products and IDs CVE-2026-16436 (CVSS v3 8.1, v4 9.2), CVE-2026-16437 and CVE-2026-16438. CVE-2023-4863 (libwebp) affects GENESIS64 and ICONICS Suite 10.97 to 10.97.2; fixed in 10.97.3 or later. Fixed versions: GENESIS 11.03 and earlier, update to 11.04 or later; GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX 10.97.3 and earlier, update to 10.98 or later. No fix is planned for MC Works64, GENESIS32 or BizViz. Exploitation status None known, according to the advisory. Why it matters to OT operators These SCADA and historian products are used for monitoring and control in industrial plants, and some older products will never get a fix. Mitsubishi Electric advises updating where a fix exists, allowing only administrators to log in, blocking remote logins from untrusted networks and using firewalls or a VPN, restricting physical access, and replacing the challenge .dat file with a blank file that only a dedicated admin account can write to (the advisory gives the exact steps). Sources CISA ICSA-26-300-02, Mitsubishi Electric ICONICS GENESIS family, 27 Oct 2026 (revised 29 Oct) Source dates: 27 Oct 2026 (revised 29 Oct).