Weak Password Recovery Mechanism in Mitsubishi Electric GENESIS and ICONICS Products
CVE-2026-16436

9.2CRITICAL

Key Information:

Vendor: Mitsubishi Electric Corporation
Status: Genesis; Genesis64; Iconics Suite; Hyper Historian
Vendor: CVE Published:; 15 October 2026

🔔 Create Mitsubishi Electric Corporation Vulnerability Alert

What is CVE-2026-16436?

The vulnerability involves a weak password recovery mechanism in various Mitsubishi Electric products, including GENESIS and ICONICS Suite. This flaw allows a remote attacker to obtain the fixed challenge response used for unlocking the system, which is the same for all users. Consequently, an attacker could potentially access, modify, or delete sensitive internal information, or even trigger a denial-of-service condition, compromising system integrity and availability.

Affected Version(s)

AnalytiX versions 10.97.3 and prior

BizViz all versions

References

https://www.mitsubishielectric.com/psirt/vulnerability/pd...

vendor-advisory

https://jvn.jp/vu/JVNVU#93251594/

government-resource

CVSS V4

Score:

9.2

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

Physical

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 15, 2026
Vulnerability Reserved
Jul 21, 2026

CVE-2026-16436 Data

JSON