Read the docs
TI-2026-74682 Aliases CVE-2026-16438GHSA-qcw9-8pcc-76g9

Excess DCOM permissions in Mitsubishi Electric Iconics products

Priority MEDIUM 42CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI versions through 10.97.3, and MC Works64 in all versions, are affected. The installers grant default DCOM permissions to the product administrator account, which is an incorrect privilege assignment (CWE-266). An attacker who can log in with that administrator account, locally or remotely, can launch and operate DCOM objects that should require UAC elevation, and may disclose, tamper with, destroy or delete information or cause a denial-of-service condition.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mitsubishi Electric CorporationGENESIS64up to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsGENESIS64up to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationICONICS Suiteup to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsICONICS Suiteup to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationHyper Historianup to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsHyper Historianup to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationAnalytiXup to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsAnalytiXup to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationMobileHMIup to 10.97.3—No fix listedCNA
Mitsubishi Electric Iconics Digital SolutionsMobileHMIup to 10.97.3—No fix listedCNA
Mitsubishi Electric CorporationMC Works64all versions—No fix listedCNA

Remediation

No fixed version is listed for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI or MC Works64.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Mitsubishi Electric AnalytiX, GENESIS64 and 4 more products — mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.…

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-74680 Weak password recovery in Mitsubishi Electric GENESIS softwarePriority MEDIUM 42
    • TI-2026-74681 Weak password recovery in Mitsubishi Electric ICONICS productsPriority LOW 32
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-16438
  2. 2026-11-05 2 new references · CNA
  3. 2026-11-05 Alias added: GHSA-qcw9-8pcc-76g9

References

Advisory 1

Other 2

  • TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
  • TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
  • TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
  • TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
  • TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
  • TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
See all 151 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences