Key points
- The flaw affects Mitsubishi Electric GENESIS versions 11.03 and prior, along with multiple related software suites.
- National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.2.
- Attackers can exploit the fixed challenge response to bypass password recovery and unlock the system remotely.
Mitsubishi Electric GENESIS and several associated industrial software products contain a critical security flaw that allows remote attackers to bypass password recovery mechanisms. The National Vulnerability Database identifies this issue as CVE-2026-16436, assigning it a CVSS score of 9.2, which classifies it as critical. The vulnerability stems from a weak password recovery mechanism where the challenge response used to unlock the system is fixed and common to all users. This design flaw means an attacker who obtains the challenge response by any means can unlock the system without possessing valid user credentials.
By the numbers
- 9.2: The CVSS score assigned to CVE-2026-16436 by the National Vulnerability Database, indicating a critical severity level.
- 11.03: The highest version number of Mitsubishi Electric GENESIS affected by this vulnerability; all prior versions are also impacted.
- 10.97.3: The highest version number of GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX affected by the flaw.
What the figures mean
The high severity score reflects the ease with which an attacker can exploit this weakness. Because the challenge response is static and shared across all users, there is no unique cryptographic protection for individual accounts. Once an attacker acquires this fixed response, they can unlock the system entirely.
The vulnerability affects a broad range of products, including GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. For BizViz, MC Works64, and GENESIS32, all versions are affected. The flaw allows remote attackers to disclose, tamper with, destroy, or delete internal information. It can also cause the affected system to enter a denial-of-service condition.
What should you do?
Managed service providers must immediately inventory client environments to identify any installations of the affected Mitsubishi Electric software versions. Teams should verify if these systems are accessible from untrusted networks, as the vulnerability allows remote exploitation. Organizations should review access logs for any unusual unlock attempts or successful logins that do not match standard authentication patterns. It is essential to coordinate with internal security teams and suppliers to assess the scope of exposure. Isolating affected systems from external networks may be necessary to prevent unauthorized access.
Operational impact
Organizations should ask their IT and security teams to map all instances of affected software across client networks. Determine which systems are
