noindex and left out of the sitemap until more data is confirmed.CVE-2026-16438 is an incorrect privilege assignment (CWE-266) in the installers of Mitsubishi Electric's GENESIS64/ICONICS SCADA and HMI product line: default DCOM permissions are unnecessarily granted to the product's administrator account, so a user with that account can locally or remotely launch and operate DCOM objects that should require UAC elevation; NVD has not yet published its own analysis, so this page stays noindex until that analysis lands.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-15
Published
Vulnerability ID: CVE-2026-16438 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Mitsubishi Electric GENESIS64 / ICONICS Suite (incl. bundled Hyper Historian, AnalytiX, MobileHMI) | — | 10.97.3 and prior (fixed in ICONICS Suite 10.98 or later) |
| Mitsubishi Electric MC Works64 | — | All versions; no fixed version planned — vendor recommends the DCOM-exposure mitigation below or migrating to GENESIS64/GENESIS |
What this means
CVE-2026-16438 affects Mitsubishi Electric's GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64 — the same ICONICS-platform SCADA/HMI and industrial data-visualisation family covered by the related CVE-2026-16436 and CVE-2026-16437. NVD's weakness field assigns CWE-266 (Incorrect Privilege Assignment); NVD's description states the vulnerability lets "an attacker who can log in using the same administrator account for the affected products... locally or remotely launch and operate DCOM objects," potentially leading to information disclosure, tampering, destruction or deletion of information, or a denial-of-service condition (NVD).
NVD's status for this CVE is "Awaiting Analysis" as of 2026-10-27, so there is no NVD-published CVSS score. The only severity figure on record is Mitsubishi Electric's own CNA submission: CVSS v4.0 9.4 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — this is the vendor's score, not an NVD-published one, and this page leaves cvss_score unset rather than present it as NVD-confirmed (NVD).
Mitsubishi Electric's PSIRT advisory (release 2026-10-15) explains the root cause directly: "During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. As a result, users with that administrator account can locally or remotely launch and operate DCOM objects that should require UAC elevation." The same advisory groups CVE-2026-16438 with three related CVEs in the same product family (CVE-2023-4863 libwebp out-of-bounds write, and CVE-2026-16436/CVE-2026-16437, two variants of a weak challenge-response password-recovery flaw), but CVE-2026-16438 carries the vendor's highest CVSS v4.0 score of the group (9.4) because its impact spans confidentiality, integrity and availability at both the vulnerable-system and subsequent-system level (Mitsubishi Electric PSIRT Advisory 2026-006).
Fixes are available for most of the affected line: GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI are fixed in ICONICS Suite 10.98 or later. MC Works64 has no fixed version planned — the vendor recommends migrating to GENESIS64 or GENESIS instead. Where upgrading is not immediately possible, Mitsubishi Electric's specific mitigation for this CVE is to keep the host PC inside the LAN and block access from untrusted networks and hosts through a firewall, use a firewall/VPN for any required remote access, and run anti-virus software both on the host PC and on any PC that can reach it (Mitsubishi Electric PSIRT Advisory 2026-006).
CISA republished this advisory as ICSA-26-300-02 on 2026-10-27, affecting Critical Manufacturing sector deployments worldwide, alongside the same four CVEs (CISA ICS Advisory ICSA-26-300-02).
CVE-2026-16438 is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27, and FIRST scores the probability of exploitation at 0.00253 (16.738th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, operators of affected GENESIS64/ICONICS deployments should apply the vendor's upgrade or restrict DCOM/network access to the host PC as described above.
Evidence
- Installers unnecessarily grant default DCOM permissions to the products' administrator account, letting a user with that account launch/operate DCOM objects that should require UAC elevation (CWE-266), risking disclosure, tampering/destruction of data, or DoS. — NVD
- NVD status is "Awaiting Analysis" as of 2026-10-27; the only severity data is Mitsubishi Electric's CNA-submitted CVSS v4.0 9.4 (critical), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H — not an NVD-published score. — NVD
- Fixed in ICONICS Suite 10.98+ (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI); MC Works64 has no fix planned. Mitigation: restrict network/DCOM access to the LAN, use firewall/VPN, run anti-virus on the host and reachable PCs. — Mitsubishi Electric PSIRT Advisory 2026-006
- Republished by CISA as ICSA-26-300-02 on 2026-10-27, affecting Critical Manufacturing sector deployments worldwide, alongside the three related Mitsubishi Electric/ICONICS CVEs. — CISA ICS Advisory ICSA-26-300-02
- Not present in the CISA KEV catalog as of 2026-10-27; EPSS score is 0.00253 (16.738th percentile) as of 2026-10-27. — FIRST EPSS
