Critical flaw in Mitsubishi GENESIS lets attackers bypass password recovery
A fixed challenge response in Mitsubishi Electric software allows remote attackers to unlock systems and access internal data without valid credentials.
Key points
- CVE-2026-16436 is rated Critical with a CVSS score of 9.2 by the National Vulnerability Database.
- The flaw affects GENESIS, GENESIS64, ICONICS Suite, and other Mitsubishi Electric products up to version 11.03 or 10.97.3.
- Attackers can exploit the weak password recovery mechanism to unlock the system because the challenge response is fixed for all users.
The National Vulnerability Database has published details on CVE-2026-16436, a critical vulnerability in Mitsubishi Electric industrial software that allows remote attackers to bypass authentication. The flaw, rated 9.2 on the CVSS scale, stems from a weak password recovery mechanism that uses a fixed challenge response.
At a glance
- CVE
- CVE-2026-16436
- Product
- Mitsubishi Electric Corporation GENESIS
- CVSS
- 9.2 Critical
- Weakness
- CWE-640
- Exploited
- No known exploitation
According to the NVD record, the vulnerability enables an attacker to unlock the affected system by obtaining the challenge response through various means. Because this response is common to all users and remains fixed, it does not provide unique security per account. This design flaw allows unauthorized individuals to gain access without knowing specific user passwords.
Context and Background
The vulnerability is classified under CWE-640, which relates to weak password recovery mechanisms for forgotten passwords. The NVD description states that an attacker may disclose, tamper with, destroy, or delete internal information once the system is unlocked. Additionally, the exploitation of this flaw could cause the affected system to enter a denial-of-service condition, disrupting operations.
The fixed nature of the challenge response means that any entity capable of intercepting or deriving this value can effectively reset or bypass the login process. This creates a significant risk for systems that rely on this recovery method for administrative access or user authentication. The lack of variability in the response undermines the security of the entire authentication layer.
Who Is Affected
Multiple Mitsubishi Electric products are impacted by CVE-2026-16436. Affected versions include GENESIS 11.03 and prior, GENESIS64 10.97.3 and prior, and ICONICS Suite 10.97.3 and prior. Other affected products include Hyper Historian, AnalytiX, MobileHMI, and IoTWorX, all up to version 10.97.3.
The vulnerability also affects all versions of MC Works64, GENESIS32, and BizViz. The NVD record lists both Mitsubishi Electric Corporation and Mitsubishi Electric Iconics Digital Solutions as vendors for the affected GENESIS, GENESIS64, and ICONICS Suite products. Users of these specific version ranges should verify their installations against the listed criteria.
What should you do?
Organizations using these Mitsubishi Electric products should immediately assess their exposure to CVE-2026-16436. Since no patch or fix has been confirmed in the source material, users must rely on compensating controls. Network segmentation can limit remote access to these systems. Administrators should monitor for unauthorized login attempts or unusual system behavior that might indicate exploitation.
What to do and how to stay safe: CVE-2026-16436
- Inventory all instances of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, and related products to identify affected versions.
- Restrict network access to these systems using firewalls or segmentation to prevent remote attackers from reaching the login interface.
- Monitor system logs for signs of unauthorized access or repeated failed login attempts that could indicate exploitation of the recovery mechanism.
- Ensure that sensitive data stored on these systems is encrypted at rest to limit damage if an attacker gains access.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-16436?
The National Vulnerability Database rates CVE-2026-16436 as Critical with a CVSS score of 9.2.
Which Mitsubishi Electric products are affected by this vulnerability?
Affected products include GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz, depending on version.
Is there a patch available for this vulnerability?
The source material does not confirm the availability of a patch, fix, or update for CVE-2026-16436.
