Mitsubishi Electric GENESIS64 Critical Flaw Lets Admins Run Code Without UAC Elevation
A critical vulnerability in Mitsubishi Electric’s industrial software suite allows attackers with admin access to bypass security controls and execute code remotely.
Key points
- CVE-2026-16438 affects GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64.
- The flaw is rated CVSS 9.4 Critical and stems from incorrect privilege assignment during installation.
- Attackers can launch DCOM objects locally or remotely without requiring User Account Control elevation.
Mitsubishi Electric has disclosed a critical vulnerability in its GENESIS64 platform and related industrial software products. The flaw, tracked as CVE-2026-16438, allows an attacker who has obtained administrator credentials to bypass standard security restrictions. According to the National Vulnerability Database, this incorrect privilege assignment enables the remote or local execution of Distributed Component Object Model objects. The issue impacts multiple components within the Mitsubishi Electric Iconics Digital Solutions ecosystem, posing significant risks to organisations relying on these systems for operational technology management.
Root cause
The vulnerability originates from the installation process of the affected software packages. During setup, the installers automatically grant default DCOM permissions to the administrator account associated with the product. This configuration error means that users with these administrative accounts can launch and operate DCOM objects that would normally require User Account Control elevation. The National Vulnerability Database classifies this weakness as CWE-266, indicating an incorrect privilege assignment that undermines the system’s intended security boundaries.
Attack path
An attacker must first gain access using an administrator account for one of the affected products. Once authenticated, they can exploit the excessive permissions granted to that account. This allows the attacker to launch and operate DCOM objects either locally on the machine or remotely across the network. Consequently, the attacker may disclose, tamper with, destroy or delete internal information. They can also cause the affected system to enter a denial-of-service condition, disrupting industrial operations that depend on the continuity of these software services.
Affected versions
- Mitsubishi Electric GENESIS64 versions 10.97.3 and prior
- ICONICS Suite versions 10.97.3 and prior
- Hyper Historian versions 10.97.3 and prior
- AnalytiX versions 10.97.3 and prior
- MobileHMI versions 10.97.3 and prior
- MC Works64 all versions
Mitigation
- Audit administrator accounts used for GENESIS64 and related products to identify excessive DCOM permissions.
- Restrict remote access to systems running vulnerable versions of the affected software.
- Monitor for unusual DCOM object launches or unexpected service interruptions on affected hosts.
- Isolate critical industrial control systems from general corporate networks where possible.
What it means for organisations
Teams should review their inventory of Mitsubishi Electric industrial software to identify instances of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI or MC Works64. Security leaders need to determine if administrator accounts for these products have broader network access than necessary. Operations managers should assess the potential impact of a denial-of-service condition on production lines. IT and OT teams must collaborate to verify that DCOM permissions are not excessively granted during software installations. Communicating this risk to suppliers who host these applications is also advisable.
What to do and how to stay safe: Mitsubishi Electric
- Verify if your environment runs any of the listed Mitsubishi Electric products at vulnerable versions.
- Ensure administrator accounts for these systems are not used for general network access.
- Monitor logs for unauthorized DCOM object launches or unexpected privilege escalations.
- Consult with your vendor to confirm if a patch or configuration update is available.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific products are affected by CVE-2026-16438?
GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64 are all affected.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-16438 as Critical with a CVSS score of 9.4.
Does this flaw allow remote code execution?
Yes, attackers with administrator access can remotely launch and operate DCOM objects.
