Mitsubishi Electric recommends updating to the latest fixed versions (10.97.3 or later for GENESIS64 and ICONICS Suite). As interim measures, organizations should restrict administrator logins, block remote access from untrusted networks and non-administrator users, deploy firewall or VPN protections, restrict physical access to affected workstations, and prevent users from opening emails or attachments from untrusted sources. Blocking remote login via internet-facing interfaces is strongly advised.
Quick answers
What is CVE-2026-16438?
Mitsubishi Electric recommends updating to the latest fixed versions (10.97.3 or later for GENESIS64 and ICONICS Suite). As interim measures, organizations should restrict administrator logins, block remote access from untrusted networks and non-administrator users, deploy firewall or VPN protections, restrict physical access to affected workstations, and prevent users from opening emails or attachments from untrusted sources. Blocking remote login via internet-facing interfaces is strongly advised.
How severe is CVE-2026-16438?
critical, CVSS 9.1
Is CVE-2026-16438 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-16438 be mitigated?
Mitsubishi Electric recommends updating to the latest fixed versions (10.97.3 or later for GENESIS64 and ICONICS Suite). As interim measures, organizations should restrict administrator logins, block remote access from untrusted networks and non-administrator users, deploy firewall or VPN protections, restrict physical access to affected workstations, and prevent users from opening emails or attachments from untrusted sources. Blocking remote login via internet-facing interfaces is strongly advised.
Mitsubishi Electric recommends updating to the latest fixed versions (10.97.3 or later for GENESIS64 and ICONICS Suite). As interim measures, organizations should restrict administrator logins, block remote access from untrusted networks and non-administrator users, deploy firewall or VPN protections, restrict physical access to affected workstations, and prevent users from opening emails or attachments from untrusted sources. Blocking remote login via internet-facing interfaces is strongly advised.
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions have released security advisories detailing multiple vulnerabilities affecting GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz. The flaws range from an out-of-bounds write in libwebp (CVE-2023-4863, CVSS 9.1) to three authentication bypass and arbitrary operation issues (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438). Successful exploitation could allow arbitrary code execution, authentication bypass, information disclosure, data tampering, and denial-of-service conditions. Fixed versions 10.97.3 or later are available for affected products.