Mitsubishi Electric Patches Critical Flaws in Factory-Floor Software Used Worldwide

Key points

• A critical flaw tracked as CVE-2026-16436 lets a remote attacker bypass authentication in Mitsubishi Electric's GENESIS and ICONICS plant-monitoring software because every install ships with the same hard-coded recovery code.
• The same product line is also exposed to CVE-2023-4863, the libwebp image-handling bug Google patched in Chrome in September 2023 and that CISA added to its Known Exploited Vulnerabilities catalogue on 2023-09-13.
• Mitsubishi Electric released fixed version 10.97.3 for GENESIS64 and ICONICS Suite, and GENESIS 11.04 for the newer line.
• MC Works64, GENESIS32 and BizViz are listed as affected in all versions, with no vendor fix available.
• The software runs in critical manufacturing plants worldwide, and the vendor's workaround is to keep these machines behind a firewall with admin-only logins.

Mitsubishi Electric has shipped fixes for a batch of vulnerabilities in the software factory operators use to watch machines run, and one of them is the kind of mistake you rarely see in shipped industrial code.

The worst, tracked as CVE-2026-16436, carries a CVSS score of 9.1. The software offers a challenge-response unlock when a user forgets their password. That response is identical on every installation and never changes. Anyone who learns it can bypass authentication remotely and read, alter or delete data, or knock the whole system offline.

A second bug, CVE-2026-16437, lets a local administrator tamper with the file storing that same recovery value. Lower severity, same root cause.

The advisory also lists a fourth vulnerability, CVE-2026-16438, covering incorrect privilege assignment. SOURCE confirms it affects GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64.

What is the affected software actually used for?

It sits in the control room. GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX are human-machine interface and historian products: the dashboards plant operators rely on and the databases recording what the machines did. CISA's advisory lists deployment as worldwide, in critical manufacturing.

Break into one of these and you're not stealing credit cards. You're looking at the recipe for a production line.

How bad is the shared-code problem?

Bad, because the fix for individual customers is the vendor fix, not a configuration change. The challenge response is baked in. Mitsubishi Electric's security advisory 2026-006 points customers at version 10.97.3 of GENESIS64 and ICONICS Suite, and GENESIS 11.04 for the newer product line. Older products including MC Works64, GENESIS32 and BizViz carry no patched build.

For anyone who can't patch straight away, the vendor's mitigations read like a checklist of things these machines should already be doing: admin-only login, no exposure to untrusted networks, a firewall or VPN in front, restricted physical access. If an operator panel needs that advice, it probably shouldn't be reachable from a corporate laptop.

Why is a 2023 Chrome bug in this advisory?

Because the software bundles libwebp, the image library at the heart of CVE-2023-4863. Google patched it in Chrome on 2023-09-12 after in-the-wild exploitation, and CISA set a federal patch deadline of 2023-10-04. Mitsubishi Electric is only now shipping a GENESIS64 and ICONICS Suite build that pulls in the fixed library, so an attacker who gets an administrator to import a crafted image file can still trigger a heap buffer overflow and run arbitrary code.

That gap, two years between a known-exploited browser bug and the matching fix in industrial software embedding the same code, is the part worth sitting with. Software bills of materials exist for exactly this reason. This is the third Mitsubishi Electric vulnerability advisory we've covered since July, following our September story on CVE-2026-13584, and OT vendors are still slower than the rest of the industry to act on embedded library debt.

No public exploitation of the Mitsubishi-specific bugs has been reported. The libwebp flaw has been exploited for years in other contexts. Plant operators running any of the listed products should treat the 10.97.3 or 11.04 upgrade as the first order of business this week, and audit which HMIs can be reached from anywhere outside the control network.