CVE-2026-16438
CRITICAL 9.4Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Severe if exploited (CVSS 9.4), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 17th percentile
Impact if exploited
9.4CVSS 4.0 · CRITICAL
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Mitsubishi Electric Corporation Mitsubishi Electric Iconics Digital Solutions
Products Genesis64 Iconics Suite Hyper Historian Analytix Mobilehmi Mc Works64
Weakness (CWE)
- CWE-266: Incorrect Privilege Assignment
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References and research data (JSON)
All CVSS metrics
- CRITICAL 9.4 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CRITICAL 9.4 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
Advisories
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf CVE record · Mitsubishi · Updated 2026-10-16T05:41:46.956Z
NVD · CVE-2026-16438 · Updated 2026-10-16T06:17:11.153 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101942 EUVD · EUVD-2026-101942