CVE-2026-16437: Mitsubishi Electric/ICONICS GENESIS Weak Password Recovery (pending)

CVE-2026-16437 is a weak-password-recovery flaw in the security challenge feature shared across Mitsubishi Electric's GENESIS/ICONICS industrial SCADA and HMI product line: an authenticated local user who already has administrator privileges can tamper with the file that stores the challenge response and unlock the system, and it is not yet listed in NVD or the CISA KEV catalog, so this page stays noindex until an NVD-confirmed score or KEV listing lands.

CVE-2026-16437 affects GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz — Mitsubishi Electric's (via its ICONICS Digital Solutions unit) family of SCADA, HMI and IIoT products used in critical manufacturing. NVD's description states that "administrators are able to read and write the management file" that stores the security-challenge response used to unlock the system, and "as a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition" (NVD).

This CVE's NVD status is "Awaiting Analysis" as of 2026-10-27, so there is no NVD-published CVSS score. The only CVSS figure on record is Mitsubishi Electric's own CNA-submitted CVSS v4.0 score, which NVD stores as a Secondary (not NVD-confirmed) metric: 7.1, vector CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — note the attack vector is Local and it requires High privileges already, i.e. an attacker needs to be an authenticated local administrator before this bug lets them do anything further. CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) is already CNA-assigned (NVD).

Mitsubishi Electric's own PSIRT advisory (document 2026-006, released 2026-10-15) confirms the same CVSS v4.0 7.1 figure and gives the precise mechanics: in the security-challenge feature, "administrators are able to read and write the management file that stores the challenge response used to unlock the system. The management file is protected by Windows" — meaning Windows filesystem permissions are the only real barrier, and an attacker who already holds local administrator rights can bypass that. The advisory is published alongside three related CVEs in the same products — CVE-2023-4863 (a libwebp out-of-bounds write), CVE-2026-16436 (the same weak-password-recovery class but remotely exploitable since the challenge response is "common to all users and fixed"), and CVE-2026-16438 (incorrect DCOM privilege assignment) (Mitsubishi Electric PSIRT Advisory 2026-006).

Fixes are available for most of the product line: GENESIS 11.04 or later; ICONICS Suite 10.98 or later (which also updates the bundled GENESIS64, Hyper Historian, AnalytiX and MobileHMI); and IoTWorX 10.98 or later. Mitsubishi Electric states there are no plans to release a fixed version for MC Works64, GENESIS32 or BizViz, and recommends replacing those with GENESIS64 or GENESIS instead. For this specific vulnerability and its sibling CVE-2026-16436, the vendor's concrete mitigation is to delete the existing challenge-response file (ClientChallengeTable.dat on version 10, SecurityChallenges.dat on version 11) and recreate it as a blank file with file-system write/delete access restricted to a unique administrator account, separate from the product's own administrator account — on top of the general recommendations to restrict logins to administrators, block remote login from untrusted networks, and use a firewall or VPN (Mitsubishi Electric PSIRT Advisory 2026-006). CISA republished the same four CVEs as ICSA-26-300-02, covering the Critical Manufacturing sector (CISA ICS Advisory ICSA-26-300-02).

CVE-2026-16437 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27. As of the same date, FIRST scores the probability of exploitation at 0.00093 (0.512th percentile) — very low, consistent with a bug that already requires local administrator access before it can be used (CISA KEV, FIRST EPSS).

Because NVD has not yet analysed this CVE, this page does not meet the minimum data bar for indexing and will be revisited once NVD publishes its own assessment. In the meantime, operators on GENESIS, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI or IoTWorX should update to the fixed versions above; operators still on MC Works64, GENESIS32 or BizViz should apply the file-permission mitigation and plan a migration, since no patch is coming for those three.

• Administrators can read and write the management file that stores the security-challenge response, letting an authenticated local admin disclose, tamper with, destroy, or delete internal information or cause a DoS condition (CWE-640). — NVD
• NVD status is "Awaiting Analysis" as of 2026-10-27, with no NVD-published CVSS score; the only figure on record is Mitsubishi Electric's own CNA-submitted CVSS v4.0 7.1 (AV:L/AC:H/AT:N/PR:H/UI:N/...), stored as a Secondary (not NVD-confirmed) metric. — NVD
• Confirms CVSS v4.0 7.1; the management file is Windows-protected but readable/writable by local administrators; published alongside three related CVEs (2023-4863, 2026-16436, 2026-16438) in the same product family; fixes available for GENESIS/ICONICS Suite/IoTWorX, none planned for MC Works64/GENESIS32/BizViz; mitigation is to recreate the challenge-response file with restricted permissions. — Mitsubishi Electric PSIRT Advisory 2026-006
• CISA republished the same four CVEs as ICSA-26-300-02, affecting the Critical Manufacturing sector. — CISA ICS Advisory ICSA-26-300-02
• Not present in the CISA KEV catalog as of 2026-10-27; FIRST's EPSS score is 0.00093 (0.512th percentile) as of the same date. — FIRST EPSS