Mitsubishi Electric GENESIS64 Flaw Allows Remote DCOM Abuse
A critical privilege escalation flaw in Mitsubishi Electric industrial software lets authenticated users run DCOM objects without elevation.
Key points
- CVE-2026-16438 carries a CVSS score of 9.4, rated critical by the National Vulnerability Database.
- The flaw affects GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64.
- Attackers with administrator accounts can launch DCOM objects locally or remotely without UAC elevation.
Mitsubishi Electric industrial automation software contains a critical security flaw that allows attackers to escalate privileges and execute remote commands. The National Vulnerability Database lists the issue as CVE-2026-16438 with a CVSS score of 9.4. This vulnerability stems from incorrect privilege assignment during the installation process of several key products.
At a glance
- CVE
- CVE-2026-16438
- Product
- Mitsubishi Electric Corporation GENESIS64
- CVSS
- 9.4 Critical
- Weakness
- CWE-266
- Exploited
- No known exploitation
The defect permits any user who can log in with an administrator account for the affected products to launch and operate Distributed Component Object Model (DCOM) objects. These actions can be performed both locally and remotely. Normally, such operations would require User Account Control (UAC) elevation, but the flaw bypasses this security checkpoint entirely.
Incorrect Privilege Assignment During Installation
According to the NVD record, the root cause is an incorrect privilege assignment weakness, classified as CWE-266. During the installation phase, the installers for the affected products unnecessarily grant default DCOM permissions to the administrator account. This configuration error remains in place after setup, leaving the system exposed to exploitation by anyone with valid administrator credentials.
An attacker who obtains access to an administrator account can exploit this misconfiguration to run DCOM objects that should be restricted. This capability allows the attacker to disclose, tamper with, destroy, or delete internal information stored on the affected systems. The vulnerability effectively lowers the barrier for executing high-privilege tasks without proper authorization checks.
Affected Products and Versions
The vulnerability impacts a wide range of Mitsubishi Electric and Iconics Digital Solutions products. GENESIS64 versions 10.97.3 and prior are affected, as are ICONICS Suite versions 10.97.3 and prior. Hyper Historian, AnalytiX, and MobileHMI versions 10.97.3 and prior also contain this flaw.
MC Works64 is affected across all versions, regardless of the specific build number. The NVD record lists both Mitsubishi Electric Corporation and Mitsubishi Electric Iconics Digital Solutions as vendors for the affected software. This includes multiple entries for GENESIS64, ICONICS Suite, and Hyper Historian under both vendor names.
What should you do?
No patch or fix has been confirmed yet for CVE-2026-16438. Organizations using the affected versions should assess their exposure by reviewing which systems run these specific software versions. Administrators should monitor for unusual DCOM activity or unauthorized remote execution attempts on systems running the vulnerable software.
What to do and how to stay safe: Mitsubishi Electric
- Inventory all systems running GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI or MC Works64 to identify vulnerable versions.
- Restrict access to administrator accounts on affected systems to minimize the risk of unauthorized login and exploitation.
- Monitor system logs for unexpected DCOM object launches or remote execution attempts that do not require UAC elevation.
- Isolate critical industrial control systems from general networks until a vendor update is available to reduce remote attack surfaces.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-16438?
The National Vulnerability Database assigns a CVSS score of 9.4 to this vulnerability, rating it as critical.
Which Mitsubishi Electric products are affected by this flaw?
GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI (versions 10.97.3 and prior) and MC Works64 (all versions) are affected.
How does the vulnerability allow privilege escalation?
Installers grant default DCOM permissions to administrator accounts, allowing them to launch DCOM objects remotely without UAC elevation.
