CVE-2026-16436
An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| GENESIS Mitsubishi Electric Corporation |
versions 11.03 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| GENESIS Mitsubishi Electric Iconics Digital Solutions |
versions 11.03 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| GENESIS64 Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| GENESIS64 Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| ICONICS Suite Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| ICONICS Suite Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Hyper Historian Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| Hyper Historian Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| AnalytiX Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| AnalytiX Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| MobileHMI Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| MobileHMI Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| IoTWorX Mitsubishi Electric Corporation |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| IoTWorX Mitsubishi Electric Iconics Digital Solutions |
versions 10.97.3 and prior (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| MC Works64 Mitsubishi Electric Corporation |
all versions (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| GENESIS32 Mitsubishi Electric Corporation |
all versions (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| GENESIS32 Mitsubishi Electric Iconics Digital Solutions |
all versions (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| BizViz Mitsubishi Electric Corporation |
all versions (affected)
Other versions: unaffected |
CNA: Mitsubishi |
| BizViz Mitsubishi Electric Iconics Digital Solutions |
all versions (affected)
Other versions: unaffected |
CNA: Mitsubishi |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 9.2 critical |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CNA: Mitsubishi |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdfCNA: Mitsubishi · vendor-advisory
- https://jvn.jp/vu/JVNVU93251594CNA: Mitsubishi · government-resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02CNA: Mitsubishi · government-resource
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.