CVE-2026-16436: Mitsubishi Electric GENESIS/ICONICS Suite Fixed Challenge-Response Bypass (pending)

CVE-2026-16436 is a weak password-recovery mechanism (CWE-640) in the security-challenge "unlock" feature of Mitsubishi Electric's GENESIS/ICONICS SCADA and HMI product line: the challenge response needed to unlock the system is the same fixed value for every installation, so a remote attacker who learns that value by any means can unlock the system and disclose, tamper with, destroy or delete data, or force a denial-of-service condition; NVD has not yet published its own analysis, so this page stays noindex until that analysis lands.

CVE-2026-16436 affects Mitsubishi Electric's GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz — a family of SCADA/HMI and industrial data-visualisation products built on the ICONICS platform. NVD describes it as a "Weak Password Recovery Mechanism for Forgotten Password" (CWE-640): "the challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition" (NVD).

NVD's status for this CVE is "Awaiting Analysis" as of 2026-10-27, so no NVD-confirmed CVSS score exists yet. The only severity figure on record is Mitsubishi Electric's own CNA submission: CVSS v4.0 9.2 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — this is the vendor's score, not an NVD-published one, and this page leaves cvss_score unset rather than present it as NVD-confirmed (NVD).

Mitsubishi Electric's PSIRT advisory (release 2026-10-15) explains the mechanics in more detail: in the affected products' security-challenge feature, the challenge response stored to unlock a locked system is identical for every user and does not vary per installation, so "anyone who obtains the challenge response can unlock the system." The same advisory bundles CVE-2026-16436 with three related CVEs in the same product family (CVE-2023-4863 libwebp out-of-bounds write, CVE-2026-16437 — a local, admin-only variant of the same challenge-response weakness — and CVE-2026-16438, an incorrect DCOM privilege assignment), but CVE-2026-16436 is the most severe of the group because it is remotely exploitable without authentication (AV:N, PR:N, UI:N) (Mitsubishi Electric PSIRT Advisory 2026-006).

Fixes are available for most of the product line: GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI are fixed in ICONICS Suite 10.98 or later; IoTWorX is fixed in 10.98 or later; GENESIS is fixed in 11.04 or later. MC Works64, GENESIS32 and BizViz have no fixed version planned — the vendor recommends migrating to GENESIS64 or GENESIS instead. Where upgrading is not immediately possible, Mitsubishi Electric's workaround for this CVE is to delete the stored challenge-response file (ClientChallengeTable.dat on version 10 installs, SecurityChallenges.dat on version 11) and replace it with a blank file whose write/delete access is restricted to an administrator account distinct from the product's own admin account, in addition to the general mitigations of restricting SSL/network access and physical access to the host PC (Mitsubishi Electric PSIRT Advisory 2026-006).

CISA republished this advisory as ICSA-26-300-02 on 2026-10-27, affecting Critical Manufacturing sector deployments worldwide, and repeats the same mitigations: restrict login to administrators, block remote access from untrusted hosts, use a firewall/VPN, and run anti-virus software on the host PC (CISA ICS Advisory ICSA-26-300-02).

CVE-2026-16436 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.0032 (25.095th percentile) (CISA KEV, FIRST EPSS).

Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of affected GENESIS/ICONICS deployments should apply the vendor's upgrade or file-system mitigation and restrict network access to the host PC.

• The security-challenge unlock feature uses a challenge response that is common to all users and fixed, letting a remote attacker who obtains it unlock the system and disclose, tamper with, destroy or delete information, or cause a DoS condition (CWE-640). — NVD
• NVD status is "Awaiting Analysis" as of 2026-10-27; the only severity data is Mitsubishi Electric's CNA-submitted CVSS v4.0 9.2 (critical), vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — not an NVD-published score. — NVD
• Fixed in ICONICS Suite 10.98+ (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI), IoTWorX 10.98+, GENESIS 11.04+; MC Works64/GENESIS32/BizViz have no fix planned. Workaround: delete and recreate the challenge-response .dat file with access restricted to a distinct administrator account. — Mitsubishi Electric PSIRT Advisory 2026-006
• Republished by CISA as ICSA-26-300-02 on 2026-10-27, affecting Critical Manufacturing sector deployments worldwide; recommends restricting login/network access and running anti-virus software. — CISA ICS Advisory ICSA-26-300-02
• Not present in the CISA KEV catalog as of 2026-10-27; EPSS score is 0.0032 (25.095th percentile) as of 2026-10-27. — FIRST EPSS