Four flaws affect Mitsubishi Electric and ICONICS software, CISA, the US cyber agency, said on 27 October 2026. Ten products are named, including GENESIS64, ICONICS Suite, Hyper Historian and MC Works64. CISA says CVE-2023-4863 could let an attacker run code of their choice. CVE-2026-16436 and CVE-2026-16437 could let one skip the login check. CVE-2026-16438 could allow arbitrary operations. Possible results include leaked data, tampering, deletion and an outage.
Mitsubishi Electric says version 10.97.3 or later fixes GENESIS64 and ICONICS Suite, and 11.04 or later fixes GENESIS. No fixed version is named for the other products so far. For customers who cannot update, the vendors suggest admin-only login, LAN-only use with remote login blocked, a firewall or VPN, and limits on physical access. The advisory also lists CWE-787, a bug where a program writes data outside its assigned memory. What the arbitrary operations are is not stated.
A login bypass means the password check may not stop an intruder who can reach the PC. Where no fix is named, how the PCs are connected becomes the main defence. Budget owners can ask which PCs run these products, which lack a fixed version, and who can reach them remotely.