As reported by CISA in advisory ICSA-26-300-02, Mitsubishi Electric disclosed a cluster of vulnerabilities spanning an extensive portfolio of industrial automation and HMI products. The breadth of affected software — ten distinct product lines including GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and the legacy GENESIS32 and BizViz platforms — signals a systemic issue rather than an isolated coding defect. For critical manufacturing operators, this is a reminder that SCADA software suites often share authentication and rendering components across product families, amplifying the blast radius of a single flaw.
Vulnerability Summary
| CVE ID | Type | CVSS v3 | Impact | Affected Products |
|---|---|---|---|---|
| CVE-2023-4863 | Out-of-bounds Write (CWE-787) | 9.1 (Critical) | Heap-based buffer overflow via libwebp; arbitrary code execution (authenticated local) | GENESIS64 >=10.97 to <=10.97.2; ICONICS Suite >=10.97 to <=10.97.2 |
| CVE-2026-16436 | Weak Password Recovery Mechanism (CWE-640) | High (estimated) | Authentication bypass | GENESIS <=11.03; GENESIS64 <=10.97.3; ICONICS Suite <=10.97.3; Hyper Historian <=10.97.3; AnalytiX <=10.97.3; MobileHMI <=10.97.3; IoTWorX <=10.97.3; MC Works64 (all); GENESIS32 (all); BizViz (all) |
| CVE-2026-16437 | Incorrect Privilege Assignment (CWE-266) | High (estimated) | Authentication bypass / privilege escalation | Same as CVE-2026-16436 |
| CVE-2026-16438 | Arbitrary Operations | High (estimated) | Information disclosure, tampering, deletion, DoS | GENESIS64 <=10.97.3; ICONICS Suite <=10.97.3; Hyper Historian <=10.97.3; AnalytiX <=10.97.3; MobileHMI <=10.97.3; MC Works64 (all) |
Exploitation Status and Patch Availability
CISA has not confirmed active exploitation in the wild as of the advisory date. Mitsubishi Electric has released updated versions; operators should consult the vendor's security portal for specific patch targets. CVE-2023-4863 is particularly notable — it is a libwebp vulnerability that was widely exploited across consumer applications in late 2023, and its presence in GENESIS64 and ICONICS Suite demonstrates how long-unpatched third-party libraries persist in ICS environments long after upstream fixes are available.
Why This Matters
The inclusion of all versions of MC Works64, GENESIS32, and BizViz is especially alarming. These are end-of-life or legacy products that may never receive patches, yet they remain deployed in operational technology (OT) networks worldwide. Attackers targeting authentication bypass flaws in these platforms could pivot into process control networks, manipulate historian data, or disrupt manufacturing lines without needing initial credentials.
The authentication bypass vulnerabilities (CVE-2026-16436 and CVE-2026-16437) are the more strategically dangerous of the group. While CVE-2023-4863 requires authenticated local access, the auth bypass flaws could enable remote attackers to establish a foothold directly, after which the arbitrary operations vulnerability (CVE-2026-16438) becomes the tool for impact.
The combination of authentication bypass followed by arbitrary operations creates a kill-chain that requires no stolen credentials and no specialized exploit reliability — only network access to the affected HMI or historian service.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and identify: Enumerate all instances of GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz in your environment. Prioritize by network exposure and criticality of the controlled process.
- Patch supported products: Upgrade GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX to versions above 10.97.3. Upgrade GENESIS to versions above 11.03. Consult Mitsubishi Electric's advisory for exact patched version numbers and update procedures.
- Isolate legacy systems: For MC Works64, GENESIS32, and BizViz on all versions, implement strict network segmentation. Place these systems behind dedicated firewalls with deny-by-default policies. Restrict access to a hardened jump host with multi-factor authentication.
- Address libwebp exposure: If GENESIS64 or ICONICS Suite cannot be immediately upgraded past 10.97.2, verify whether the bundled libwebp library can be independently updated or whether the vendor provides a hotfix specifically for CVE-2023-4863.
- Monitor for exploitation: Deploy detection rules for anomalous authentication events on affected HMI systems. Monitor for unexpected process spawning on workstations running GENESIS64 or ICONICS Suite, which could indicate CVE-2023-4863 exploitation.
- Restrict service exposure: Ensure that HMI web interfaces, MobileHMI endpoints, and IoTWorX APIs are not accessible from outside the control network. If remote access is required, enforce VPN with MFA rather than direct internet exposure.
Longer-Term Considerations
- SBOM integration: The libwebp vulnerability surfacing three years after its original disclosure highlights the need for software bill of materials tracking in OT environments. Demand SBOMs from ICS vendors and maintain an internal inventory of third-party library dependencies.
- Legacy product lifecycle planning: MC Works64, GENESIS32, and BizViz with no patch path represent unacceptable risk in safety-critical environments. Begin migration planning now, including budget cycles and vendor evaluation for replacement platforms.
- Zero-trust for OT: Authentication bypass vulnerabilities underscore that perimeter defenses are insufficient. Implement identity-aware access controls at the OT layer, including network-level enforcement between HMI workstations and controller networks.
The scale of this advisory — ten products, four CVEs, and multiple end-of-life platforms with no patch path — reflects a broader industry problem. ICS vendors must adopt modern secure development practices including third-party library management, and asset owners must treat HMI software as internet-facing infrastructure even when it sits behind a firewall.
