CVE-2026-16438
Received Received - Intake

Incorrect Privilege Assignment in Mitsubishi Electric GENESIS64

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Mitsubishi Electric Corporation

Description
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-16438
EUVD
EUVD-2026-101942

Affected Vendors & Products

Showing 11 associated CPEs
Vendor Product Version / Range
Mitsubishi Electric Corporation GENESIS64 versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior
Mitsubishi Electric Corporation ICONICS Suite versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior
Mitsubishi Electric Corporation Hyper Historian versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior
Mitsubishi Electric Corporation AnalytiX versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior
Mitsubishi Electric Corporation MobileHMI versions 10.97.3 and prior
Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior
Mitsubishi Electric Corporation MC Works64 all versions

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect privilege assignment in Mitsubishi Electric and ICONICS software products. During installation, default DCOM permissions are granted to administrator accounts, allowing users with those accounts to locally or remotely launch and operate DCOM objects without proper User Account Control (UAC) elevation. This can lead to unauthorized access and control of the affected systems.

Impact Analysis

An attacker exploiting this vulnerability could disclose, tamper with, destroy, or delete internal information. They may also cause the affected system to enter a denial-of-service (DoS) condition, disrupting normal operations.

Mitigation Strategies

Review and restrict DCOM permissions for administrator accounts in affected Mitsubishi Electric and ICONICS products. Remove unnecessary default DCOM permissions granted during installation. Apply the latest patches from Mitsubishi Electric for versions 10.97.3 and prior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16438. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart