MITSUBISHI Electric has issued a security advisory dated 15 October 2026 outlining four critical and high-severity flaws in the ICONICS Suite and related GENESIS64/GENESIS products. The vulnerabilities enable a range of attacker actions, including authentication bypass and arbitrary code execution, potentially allowing an attacker to steal, alter or delete data and disrupt operations across industrial automation software such as ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64.
The advisory lists four CVEs: CVE-2026-16438, CVE-2026-16436, CVE-2026-16437 and CVE-2023-4863, with CVSSv4 scores up to 9.4 for the most severe issues. Public exploitation has been confirmed for one of the flaws, CVE-2023-4863, which affected multiple GENESIS/ICONICS lines.
In terms of impact and remediation, the vendor reports patch availability in ICONICS Suite/IoTWorX version 10.98 and GENESIS version 11.04 (plus related fixes in 116.0.5845.187 and 1.3.2 for affected components). CVE-2023-4863 has already been resolved in ICONICS Suite version 10.97.3, while CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438 are addressed in the newer updates.
Affected products include GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz, with some lines (notably MC Works64, GENESIS32 and BizViz) not receiving patches. For unpatched systems, the advisory recommends restricting network access via firewalls and VPNs, and applying the provided workarounds such as replacing ChallengeTable[.]dat/SecurityChallenges[.]dat with blank files and tightening write permissions. No active exploitation in the wild for the newer flaws has been confirmed at the time of the advisory.