CVE-2026-16436 Mitsubishi Electric CVE debrief

Who should care

Defenders and administrators of Mitsubishi Electric products, including GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz, should assess exposure and prioritize remediation to prevent potential disclosure, tampering, or denial-of-service conditions. They should review system integrity, internal information, and potential exposures based on available information.

Why it matters

This vulnerability allows remote attackers to unlock systems using a common, fixed challenge response. Defenders and administrators of Mitsubishi Electric products should assess exposure and prioritize remediation to prevent potential disclosure, tampering, or denial-of-service conditions.

• Potential disclosure of internal information
• Possible tampering or destruction of internal information
• Denial-of-service (DoS) condition
• Verification of system integrity and internal information

Technical summary

The vulnerability exists in multiple Mitsubishi Electric products, including GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions. An attacker can exploit this by obtaining a challenge response, which is common to all users and fixed, allowing them to unlock the system. This could lead to disclosure, tampering, destruction, or deletion of internal information, or cause a denial-of-service (DoS) condition.

Defensive priority

High

Recommended defensive actions

• Review and update passwords for all users
• Implement additional authentication mechanisms
• Monitor system logs for suspicious activity
• Verify system integrity and internal information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Mitsubishi Electric products such as GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. However, the vendor and product names are not fully specified, and the affected versions are only partially listed. Defenders should verify system integrity, internal information, and potential exposures based on available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.