Incorrect Privilege Assignment in Mitsubishi Electric GENESIS64 and Related Products
CVE-2026-16438

9.4CRITICAL

Key Information:

Vendor

Mitsubishi Electric Corporation

Status
Genesis64
Iconics Suite
Hyper Historian
Analytix
Vendor
CVE Published:
15 October 2026

What is CVE-2026-16438?

A vulnerability exists within Mitsubishi Electric GENESIS64 and its related products that entails an incorrect privilege assignment. The affected software versions allow attackers with access to an administrator account to gain unnecessary privileges, enabling them to execute DCOM objects locally or remotely without the required User Account Control (UAC) elevation. This misconfiguration may lead to data disclosure, modification, destruction, or service disruption. Organizations should assess their installations and ensure that proper security measures are in place to mitigate potential exploitation.

Affected Version(s)

AnalytiX versions 10.97.3 and prior

AnalytiX versions 10.97.3 and prior

GENESIS64 versions 10.97.3 and prior

References

https://www.mitsubishielectric.com/psirt/vulnerability/pd...
vendor-advisory
https://jvn.jp/vu/JVNVU#93251594/
government-resource

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.