CISA warns of critical flaws in Mitsubishi Electric software suite

CISA Alerts reported on October 27, 2026, that multiple vulnerabilities affect several Mitsubishi Electric software products, including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. Successful exploitation of the flaws could allow an attacker to execute arbitrary code, bypass authentication, or perform arbitrary operations. [1]

The advisory details four specific Common Vulnerabilities and Exposures identifiers: CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, and CVE-2026-16438. Attackers who exploit these weaknesses can achieve information disclosure, tamper with internal system data, or cause destruction and deletion of critical information. [1]

CISA Alerts noted a weak password recovery mechanism vulnerability, classified as CWE-640, within the affected Mitsubishi Electric systems. An authenticated local user who possesses administrative privileges could unlock the system by tampering with the challenge response management file, despite the file being protected by Windows. [1]

Mitsubishi Electric Iconics Digital Solutions, Incorporated, operates as a wholly owned subsidiary of Mitsubishi Electric. Its GENESIS automation platform and broader software portfolio are widely used across industrial, energy, defense, manufacturing, and public infrastructure sectors. [2]