Vulnerabilities

ICONICS SCADA flaws: one unlock code and loose DCOM rights

By Yaali. October 28, 2026, 6 min read, Vulnerabilities, Patching.

Mitsubishi Electric fixed four flaws in GENESIS64, ICONICS Suite and GENESIS. Three older products get no fix. Versions, the .dat workaround and checks.

Mitsubishi Electric has published four vulnerabilities in its ICONICS SCADA (supervisory control and data acquisition) and HMI (human machine interface) software: GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and IoTWorX, plus the older MC Works64, GENESIS32 and BizViz. The most serious, CVE-2026-16436 (CVSS 4.0 score 9.2), is an authentication bypass: the challenge response that unlocks the product's security is the same fixed value on every installation. Mitsubishi released its advisory, 2026-006, on October 15, and CISA republished it as ICSA-26-300-02 on October 27 for the critical manufacturing sector.

You are affected if any Windows host runs ICONICS Suite 10.97.3 or earlier, GENESIS 11.03 or earlier, or any version of MC Works64, GENESIS32 or BizViz. Those last three will not be fixed. Neither advisory reports exploitation, and the reporting we found lists no public proof of concept, so it belongs in the next patch window. Book that window now: GENESIS64 runs on plant floor hosts where an update can take weeks to schedule.

How it works

ICONICS products control who can view and change screens, tags and alarms through their own security configuration. When an administrator is locked out of that configuration, a security challenge feature lets them unlock it by answering a challenge. Mitsubishi files the flaw under CWE-640, a weak recovery mechanism for a forgotten password.

CVE-2026-16436 (9.2). The response that unlocks the system "is common to all users and fixed". Whoever learns it once can unlock any affected installation, and Mitsubishi rates it as reachable over the network with no privileges. The advisory does not say how the value could be obtained, only that a remote attacker who gets it "by some means" can unlock the system. Because the value is the same at every customer, one leak exposes every unpatched install, so plan as if it is already known.

CVE-2026-16437 (7.1). The challenge response is stored in a management file that Windows protects, but local administrators can read and write it. An attacker with admin rights on the PC can rewrite it and unlock the product's security. On version 10 the file is C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; on version 11 it is C:\ProgramData\ICONICS\11\SecurityChallenges.dat.

CVE-2026-16438 (9.4). DCOM (Distributed COM) is the Windows mechanism that lets one program start and call objects inside another, on the same machine or across the network; classic OPC data exchange is built on it. The installers grant default DCOM permissions to the product's administrator account. Anyone who signs in with that account can launch and operate, locally or remotely, DCOM objects that should require UAC (User Account Control) elevation. Mitsubishi files it as CWE-266, incorrect privilege assignment.

CVE-2023-4863 (9.3). This is the 2023 heap overflow in libwebp, the WebP image library, bundled in GENESIS64 and ICONICS Suite 10.97 to 10.97.2. Here it needs a local user to import a crafted file as a product administrator. The same bug was exploited in the wild against browsers in 2023, and CISA added it to the Known Exploited Vulnerabilities catalog on September 13 of that year.

The result for all four is the same in Mitsubishi's words: information disclosed, tampered with, destroyed or deleted, and a denial of service. On an HMI that means screens, set points and historian data.

What attackers are doing

No exploitation is reported. Mitsubishi found the flaws itself, according to CISA's republication, and the CVEs are not in the KEV catalog. The realistic risk is an intruder who already has a foothold on the plant network, for example through a remote access tool or a shared engineering workstation. A fixed unlock value and over-broad DCOM rights shorten the step from a Windows admin account to control of the SCADA configuration.

What to do

1. Find every install and its build. In Windows 11 Settings, open Apps, then Apps & features. GENESIS is affected if "ICONICS GENESIS" shows 11.3.578 or earlier. For GENESIS64, Hyper Historian, AnalytiX and MobileHMI, read the "ICONICS Suite" entry, since they are bundled with it: 10.97.306.55 or earlier is affected. Builds 10.97.020.27 to 10.97.212.46 also carry the libwebp flaw.
2. Upgrade. ICONICS Suite 10.98 or later fixes CVE-2026-16436, 16437 and 16438 for GENESIS64, Hyper Historian, AnalytiX and MobileHMI. GENESIS 11.04 or later fixes the GENESIS issues, and IoTWorX 10.98 comes from the iconics/iotworx image on Docker Hub. Suite 10.97.3 already fixed CVE-2023-4863. Installers are on the ICONICS community product downloads page.
3. If you cannot upgrade yet, neutralise the challenge file. Delete the .dat file at the path above for your version, create a blank file with the same name in the same place, and restrict write and delete rights on it to one dedicated administrator account that is not the GENESIS administrator account. icacls "<path>" shows the current access list before and after.
4. Cut the network paths. Mitsubishi's mitigations: only administrators can log on to these PCs, remote login is blocked from untrusted networks and non-administrator users, and any internet access goes through a firewall or VPN (virtual private network). For CVE-2026-16438, block DCOM from untrusted hosts at the firewall: TCP 135 for the endpoint mapper plus the dynamic RPC (remote procedure call) range Windows uses. Allow it only from the OPC clients and engineering stations that need it.
5. Plan the migration off unfixed products. MC Works64, GENESIS32 and BizViz will get no fix. Mitsubishi recommends moving to GENESIS64 or GENESIS, and until then the steps above are the only protection.

Checking whether someone got there first

The advisories publish no indicators, so these are our suggestions. On each host, compare the modified time and access list of the challenge .dat file with the install date; a recent change nobody can explain is worth a closer look. In the Windows Security log, review successful logons (event 4624) with logon type 3 or 10 for the product administrator account, and flag any source address that is not a known engineering station. If process creation auditing (event 4688) is on, look for programs started under the DCOM launcher service by that account. Then check the ICONICS security configuration for users, groups or permissions you did not create.

If you find a sign of tampering, change the product administrator password and any Windows accounts used on the host, and review the project and historian data for changes before trusting it.

The wider lesson for OT software

Two of the four flaws came from defaults: an installer that hands out DCOM rights, and a recovery secret shared by every customer. A third was a 2023 library bug still shipping in a 2026 product. A vulnerability scan of the plant network would flag none of them. Ask OT vendors for a software bill of materials, which lists bundled libraries such as libwebp, and review DCOM permissions and the access lists on product folders after each install or upgrade.

Our safeguarding and hardening team reviews HMI and engineering hosts for exactly these permissions and network paths, and network penetration testing shows how far an intruder on the plant network could get. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Mitsubishi Electric PSIRT advisory 2026-006, CISA ICSA-26-300-02, Daily Security Review, Security Online, CVE-2023-4863 in the CISA KEV catalog.