Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

CISA published an ICS advisory (ICSA-26-300-02) detailing four vulnerabilities in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz products. CVE-2023-4863 is a critical out-of-bounds write vulnerability (CWE-787) in the libwebp component affecting GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2, with CVSS v4.0 score of 9.3. CVE-2026-16436 is a weak password recovery mechanism (CWE-640) allowing remote attackers to bypass authentication using a fixed common challenge response, scoring 9.2 on CVSS v4.0. CVE-2026-16437 is a related authentication bypass via local file tampering of the challenge response management file, scoring 7.1 on CVSS v4.0. CVE-2026-16438 is an incorrect privilege assignment (CWE-266) vulnerability allowing DCOM object abuse, with a critical CVSS v4.0 score of 9.4. Successful exploitation could lead to arbitrary code execution, authentication bypass, information disclosure, data tampering, or denial-of-service. No fixes are planned for legacy products MC Works64, GENESIS32, and BizViz; vendors recommend replacement with newer products.