❌

Normal view

There are new articles available, click to refresh the page.
Yesterday — 9 November 2026All CISA Advisories

CISA Adds Four Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
9 November 2026 at 07:00

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. 

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Before yesterdayAll CISA Advisories

CISA Adds One Known Exploited Vulnerability to Catalog

✇All CISA Advisories
By: CISA
6 November 2026 at 07:00

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Post-Quantum Questions to Ask Your Vendors

✇All CISA Advisories
By: CISA
5 November 2026 at 07:00

CISA, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the National Security Agency (NSA) released joint guidance and an accompanying quick-reference list to help organizations assess vendor readiness for transitioning to post-quantum cryptography (PQC). As quantum computing advances, widely used public-key cryptography will become vulnerable to compromise from cryptographically relevant quantum computers (CRQCs). To protect their systems and data, organizations must plan for and transition to PQC—which includes algorithms capable of withstanding both classical computing and quantum-enabled threats—before CRQCs become available. 

Many organizations rely on third-party vendors for managed services, cloud capabilities, and other cryptography-dependent products and services. Cryptography is also embedded in systems and devices that are difficult to update, tied to long asset lifecycles, and require vendor support or replacement—such as industrial control systems and Internet of Things (IoT) devices. Reliance on vendors means that effective PQC transition depends on vendor readiness, and early, structured engagement with these vendors is critical to planning efforts. 

Organizations can use the vendor-neutral questions outlined in this guidance to determine whether a vendor understands quantum-related risks, maintains transparency over its cryptographic implementations, and supports a secure, cost-effective and timely transition to PQC. 

Visit CISA’s PQC Initiative page for additional resources.

US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems

✇All CISA Advisories
By: CISA
5 November 2026 at 07:00

Overview

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT)—hereafter referred to as “the authoring organizations”—are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally. Organizations in the Healthcare and Public Health, Chemical, Food and Agriculture, and Transportation Systems Sectors widely use these systems, including in refrigerated transport services, for automated and remote monitoring of temperatures, continuous temperature logging, defrost cycle management, and energy optimization.

The authoring organizations urge owners and operators to defend against this activity by using strong authentication, keeping systems updated, identifying any systems that are accessible from the internet, removing unnecessary remote access, and securing any necessary remote access.

Threat

The authoring organizations are aware of malicious cyber actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.

Specifically, the actors may exploit these flaws through multiple vectors:

  • Authentication bypass;
  • Arbitrary code injection; and
  • Weak configurations.

Upon successful exploitation of the flaws, the actors could achieve the following effects:

  • Change of temperature, which could:
    • Affect the service life of the system;
    • Create a fire hazard;
    • Cause loss of inventory; or
    • Indirectly harm consumers if products are consumed after unsafe storage.
  • Loss of visibility into current temperatures (a denial-of-view condition).

Mitigations

The authoring organizations urge owners and operators to immediately take the following actions. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs), developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement:

  • Eliminate public internet exposure: Do not expose control system devices and/or systems, particularly controller panels, to the internet [CPG 3.S]. Should remote access be necessary, protect it by using a firewall or edge device and updating it to the latest version to reduce security vulnerabilities. See CISA’s Internet Exposure Reduction Guidance and Defend the Edge: The Critical Importance of Edge Device Security for additional guidance on securing edge devices.
  • Isolate operational technology (OT) devices: Create a dedicated OT virtual local area network (VLAN) to separate OT devices from business networks [CPG 3.I].
  • Enforce credential security: Change default passwords [CPG 3.A], strengthen passwords, and implement strong password policies [CPG 3.B]. Further, implement phishing-resistant multifactor authentication wherever feasible [CPG 3.F].
  • Apply patches: Keep device firmware up to date and establish a structured lifecycle management process to identify, retire, and replace legacy devices that are at end of life (EOL) and no longer supported by the manufacturer [CPG 2.A, 2.B]. See CISA’s BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk and BOD 26-02: Mitigating Risk From End-of-Support Edge Devices for additional guidance.
  • Restrict access: Define and maintain device and IP address allowlisting, limiting access to only those devices and IP addresses authorized to make changes [CPG 3.H].
  • Have reliable backups: Maintain current backups offsite and offline and test them [CPG 3.O].
  • Monitor and report: Enable logging [CPG 3.Q] and regularly review logs for unexpected activity.
    • For OT assets where logs are non-standard or not available, collect network traffic and communications between the assets.
  • Review setpoint ranges: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations.

Resources

The authoring organizations strongly urge industrial refrigeration and cold chain monitoring system owners and operators to secure remote access to their OT systems. To strengthen system security, owners and operators should review the following resources and implement recommended mitigations:

Contact Information

The authoring organizations recommend U.S. organizations report suspicious or criminal activity related to information provided in this fact sheet:

  • Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). For more information on reporting a cyber incident, refer to CISA’s Voluntary Cyber Incident Reporting web page. File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident:
    • Date, time, and location of the incident;
    • Type of activity;
    • Number of people affected;
    • Type of equipment used for the activity; and
    • Name of the submitting company or organization, and a designated point of contact.
  • Contact HHS via HHSCyber@hhs.gov or the HHS 24/7 Operations Center at 202-619-7800 for assistance mitigating potential disruptions to the delivery of healthcare resulting from health and medical supply chain impacts.

Disclaimer

The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by the authoring organizations.

 

CISA Adds One Known Exploited Vulnerability to Catalog

✇All CISA Advisories
By: CISA
4 November 2026 at 07:00

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2024-27834 Apple Multiple Products Improper Authentication Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Subnet Solutions PowerSYSTEM Center

✇All CISA Advisories
By: CISA
3 November 2026 at 07:00

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute unauthorized SQL commands and gain access to unauthorized resources.

The following versions of Subnet Solutions PowerSYSTEM Center are affected:

  • PowerSYSTEM Center 2020 <=5.29.x (CVE-2026-63017)
  • PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x (CVE-2026-63017, CVE-2026-63774)
  • PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x (CVE-2026-63017, CVE-2026-63774)
CVSS Vendor Equipment
v3 9 Subnet Solutions PowerSYSTEM Center
2 Vulnerabilities
Incorrect Authorization, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Canada

Vulnerabilities

CVE-2026-63017
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

3 Affected Products

Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x

Product Status: known_affected

Remediations

Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.

Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x

Product Status: known_affected

Remediations

Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2020 Update 30. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.

Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x

Product Status: known_affected

Remediations

Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users monitor user activity records to ensure users are following acceptable usage policies of the application. Subnet Solutions also recommends disabling PowerSYSTEM Center Client Access Server users' ability to access the browser's F12 Developer Tools.

Additional Metrics

Relevant CWE: CWE-863 Incorrect Authorization

CVSS Version Base Score Base Severity Vector String
3.1 9 CRITICAL CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 9.4 CRITICAL CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

View CVE Details

CVE-2026-63774
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

5 Affected Products

Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x

Product Status: known_affected

Remediations

Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.

Subnet Solutions PowerSYSTEM Center 2020 <=5.29.x

Product Status: known_affected

Remediations
Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x

Product Status: known_affected

Remediations

Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.

Subnet Solutions PowerSYSTEM Center 2024 >=6.0.x|<=6.2.x

Product Status: known_affected

Remediations

Mitigation
For users who are currently using PowerSYSTEM Center 2024, Subnet Solutions recommends users upgrade to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.

Subnet Solutions PowerSYSTEM Center 2026 >=7.0.x|<=7.1.x

Product Status: known_affected

Remediations

Mitigation
Subnet Solutions recommends users update to PowerSYSTEM Center 2026 Update 1.1. For assistance in upgrading, users should contact the Subnet Solutions System Integration team or customer support team at (403) 270-8885 or by email at support@subnet.com. If unable to update to the latest version, Subnet Solutions recommends users disable user access to the report designer.

Additional Metrics

Relevant CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS Version Base Score Base Severity Vector String
3.1 9 CRITICAL CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 9.4 CRITICAL CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

View CVE Details

Acknowledgments

  • Chinmay Patel of Digital Boundary Group reported these vulnerabilities to CISA.
  • Subnet Solutions reported these vulnerabilities to CISA.

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. These vulnerabilities are not exploitable remotely.

Revision History

  • Initial Release Date: 2026-11-03
Date Revision Summary
2026-11-03 1 Initial Publication

Legal Notice and Terms of Use

CISA Adds One Known Exploited Vulnerability to Catalog

✇All CISA Advisories
By: CISA
3 November 2026 at 07:00

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISA Adds Two Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
30 October 2026 at 08:00

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
  • CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Hitachi Energy CoreTec Product

✇All CISA Advisories
By: CISA
29 October 2026 at 08:00

View CSAF

Summary

Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy CoreTec Product are affected:

  • CoreTec5 vers:CoreTec5/<=3.4.0, 5.0.0 (CVE-2026-13162, CVE-2026-43284)
  • CoreTec4 vers:CoreTec4/<=3.4.0 (CVE-2026-13162)
CVSS Vendor Equipment
v3 8.8 Hitachi Energy CoreTec5
2 Vulnerabilities
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Write-what-where Condition

Background

  • Critical Infrastructure Sectors: Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

CVE-2026-13162
An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The vulnerability exists in the configuration daemon's time synchronization handler, which is responsible for setting the system timezone. When processing timezone configuration updates, the daemon constructs a shell command by concatenating user-supplied input without any sanitization or validation.

2 Affected Products

CoreTec5 versions 3.4.0 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Update to CoreTec5 version 5.0.0

CoreTec4 versions 3.4.0 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Upgrade to CoreTec5 version 5.0.0

Mitigation
Follow general mitigation factors

Additional Metrics

Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 7.7 HIGH CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-43284
A vulnerability exists in the IPsec ESP subsystem (esp4) of the Linux kernel used in CoreTec5 that allows a local unprivileged user to escalate privileges to root. The flaw exists in how the kernel handles memory pages when processing ESP encrypted network packets. An attacker can craft a packet that causes the kernel to decrypt data directly into memory pages it does not own, including cached copies of privileged operating system binaries. When one of those binaries is executed, the attacker's injected code runs with root privileges. In CoreTec5, the vulnerable ESP component is compiled in kernel as a built-in and is present at boot time allowing a local user to exploit it.

3 Affected Products

CoreTec5 versions 3.4.0 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Update to CoreTec5 version 5.0.0

CoreTec4 versions 3.4.0 and prior

Product Status: fixed, known_affected, recommended

Remediations
CoreTec5 versions 3.4.0 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Update to CoreTec5 version 5.0.0

Additional Metrics

Relevant CWE: CWE-123 Write-what-where Condition

CVSS Version Base Score Base Severity Vector String
3.1 8.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

View CVE Details

Acknowledgments

  • Ritesh Kumar Kalle, Subhojeet Mukherjee, Hishamudeen of the Cybersecurity Research group, Hitachi India R&D Center reported these vulnerabilities to CISA.

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support

For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1]

SSVC

SSVCv2/E:N/A:N/2026-10-26T15:17:24Z/

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000258 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-10-27
Date Revision Summary
2026-10-27 1 Initial public release
2026-10-29 2 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000258 advisory

Legal Notice and Terms of Use

CISA Adds Two Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
29 October 2026 at 08:00

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability
  • CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Hitachi Energy TRO600 series products

✇All CISA Advisories
By: CISA
29 October 2026 at 08:00

View CSAF

Summary

Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information. Please refer to the Recommended Immediate Actions section for information about the mitigation/remediation.

The following versions of Hitachi Energy TRO600 series products are affected:

  • TRO600 vers:TRO600/<=9.2.1.6, vers:TRO600/<=9.1.1.0, 9.2.2.1, 9.1.2.0 (CVE-2026-10756, CVE-2026-106087)
CVSS Vendor Equipment
v3 7.5 Hitachi Energy TRO600
2 Vulnerabilities
Improper Restriction of Communication Channel to Intended Endpoints, Missing Authentication for Critical Function

Background

  • Critical Infrastructure Sectors: Energy
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Switzerland

Vulnerabilities

CVE-2026-10756
TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.

1 Affected Product

TRO600 version 9.2.1.6 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Update to version 9.2.2.1

Additional Metrics

Relevant CWE: CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 7.7 HIGH CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-106087
TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.

2 Affected Products

TRO600 version 9.2.1.6 and prior

Product Status: fixed, known_affected, recommended

Remediations
TRO600 version 9.1.1.0 and prior

Product Status: fixed, known_affected, recommended

Remediations

Vendor fix
Fixed in version 9.1.2.0. Update to the latest version 9.2.2.1.

Additional Metrics

Relevant CWE: CWE-306 Missing Authentication for Critical Function

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

View CVE Details

Acknowledgments

  • Hitachi Energy Internal Team reported these vulnerabilities to CISA.

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support

For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors

Recommended security practices and firewall configurations can help protect an industrial control system network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Industrial control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the Hitachi Energy’s “Industrial Control Systems Cybersecurity Best Practices” Cybersecurity Notification. [1]

SSVC

SSVCv2/E:N/A:N/2026-10-26T14:54:19Z/

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000224 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-10-27
Date Revision Summary
2026-10-27 1 Initial Public release
2026-10-29 2 Initial CISA Republication of Hitachi Energy PSIRT 8DBD000224 advisory

Legal Notice and Terms of Use

Siemens Mendix SAML Module

✇All CISA Advisories
By: CISA
29 October 2026 at 08:00

View CSAF

Summary

Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.

The following versions of Siemens Mendix SAML Module are affected:

  • Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.4 (CVE-2026-89209)
  • Mendix SAML (Mendix 11 compatible) vers:intdot/<4.2.4 (CVE-2026-89209)
  • Mendix SAML (Mendix 9 compatible) vers:intdot/<3.6.29 (CVE-2026-89209)
CVSS Vendor Equipment
v3 6.8 Siemens Mendix SAML (Mendix 10 compatible)
1 Vulnerability
Authentication Bypass by Capture-replay

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Information Technology
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

CVE-2026-89209
Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

3 Affected Products

Mendix SAML (Mendix 10 compatible) < V4.2.4

Product Status: known_affected

Remediations

Mitigation
Disable IdP-initiated SSO

Vendor fix
Update to V4.2.4 or later version

Mendix SAML (Mendix 11 compatible) < V4.2.4

Product Status: known_affected

Remediations

Mitigation
Disable IdP-initiated SSO

Vendor fix
Update to V4.2.4 or later version

Mendix SAML (Mendix 9 compatible) < V3.6.29

Product Status: known_affected

Remediations

Mitigation
Disable IdP-initiated SSO

Vendor fix
Update to V3.6.29 or later version

Additional Metrics

Relevant CWE: CWE-294 Authentication Bypass by Capture-replay

CVSS Version Base Score Base Severity Vector String
3.1 6.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

View CVE Details

Acknowledgments

  • Siemens ProductCERT reported this vulnerability to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-137528 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-10-26
Date Revision Summary
2026-10-26 1 Publication Date
2026-10-29 2 Initial CISA Republication of Siemens ProductCERT SSA-137528 advisory

Legal Notice and Terms of Use

CISA Adds Two Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
28 October 2026 at 08:00

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability
  • CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

✇All CISA Advisories
By: CISA
27 October 2026 at 08:00

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system.

The following versions of Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz, Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, GENESIS32 and BizViz are affected:

  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64 >=10.97|<=10.97.2 (CVE-2023-4863)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite >=10.97|<=10.97.2 (CVE-2023-4863)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS <=11.03 (CVE-2026-16436, CVE-2026-16437)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS64 <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions ICONICS Suite <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions Hyper Historian <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions AnalytiX <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions MobileHMI <=10.97.3 (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions IoTWorX <=10.97.3 (CVE-2026-16436, CVE-2026-16437)
  • Mitsubishi Electric MC Works64 vers:all/* (CVE-2026-16436, CVE-2026-16437, CVE-2026-16438)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS32 vers:all/* (CVE-2026-16436, CVE-2026-16437)
  • Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions BizViz vers:all/* (CVE-2026-16436, CVE-2026-16437)
CVSS Vendor Equipment
v3 9.1 Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz, Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, HyperHistorian, AnalytiX, MobileHMI, IoTWorX, GENESIS32 and BizViz
3 Vulnerabilities
Out-of-bounds Write, Weak Password Recovery Mechanism for Forgotten Password, Incorrect Privilege Assignment

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Japan, United States

Vulnerabilities

CVE-2023-4863
Out-of-bounds Write (CWE-787) vulnerability caused by libwebp, an internal component in GENESIS64 and ICONICS Suite could allow an authenticated local attacker to cause a heap-based buffer overflow and execute arbitrary code by importing a crafted file as an administrator for the affected product. As a result, the attacker may disclose internal information, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

4 Affected Products

Mitsubishi Electric GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64 is included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64 is included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". Note: GENESIS64 is included in the ICONICS Suite installation. For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.97.3 or later for GENESIS64 and ICONICS Suite. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". Note: GENESIS64 is included in the ICONICS Suite installation. For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers using the affected product who cannot immediately update it, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Additional Metrics

Relevant CWE: CWE-787 Out-of-bounds Write

CVSS Version Base Score Base Severity Vector String
3.1 8.2 HIGH CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.0 9.3 CRITICAL CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

View CVE Details

CVE-2026-16436
Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz could allow a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

23 Affected Products

Mitsubishi Electric GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Additional Metrics

Relevant CWE: CWE-640 Weak Password Recovery Mechanism for Forgotten Password

CVSS Version Base Score Base Severity Vector String
3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.2 CRITICAL CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-16437
Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz could allow an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

42 Affected Products

Mitsubishi Electric GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 11.04 or later for GENESIS. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend performing the following steps for GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI and MC Works64, to minimize the risk of exploitation of this vulnerability. (1) Delete the .dat file at the location specified below. This file name and location is different depending on the product version. (Version 10: C:\Program Files\ICONICS\GENESIS64\Components\ClientChallengeTable.dat; Version 11: C:\ProgramData\ICONICS\11\SecurityChallenges.dat) (2) Create a blank file with the same name and location. (3) Restrict the file system write and delete access to this file to a unique administrator account, different than the GENESIS administrator account.

Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for IoTWorX. Please download the fixed version from the link below and install it: "https://hub.docker.com/r/iconics/iotworx". For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric Iconics Digital Solutions has no plans to release fixed versions for GENESIS32 or BizViz. For customers using GENESIS32 or BizViz, Mitsubishi Electric Iconics Digital Solutions recommends taking the mitigations described in the Mitsubishi Electric Iconics Digital Solutions' whitepaper which can be found at "https://iconics.com/about/security/cert". Alternatively, customers should consider replacing GENESIS32 or BizViz with GENESIS64 or GENESIS.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, to minimize the risk of exploitation of this vulnerability.

Additional Metrics

Relevant CWE: CWE-640 Weak Password Recovery Mechanism for Forgotten Password

CVSS Version Base Score Base Severity Vector String
3.1 6.4 MEDIUM CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 7.1 HIGH CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-16438
Incorrect Privilege Assignment (CWE-266) vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 could allow an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

53 Affected Products

Mitsubishi Electric GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS64: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: >=10.97|<=10.97.2

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS: <=11.03

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric IoTWorX: <=10.97.3

Product Status: known_affected

Remediations
Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric GENESIS32: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric BizViz: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS: <=11.03

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric IoTWorX: <=10.97.3

Product Status: known_affected

Remediations
Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric GENESIS32: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric BizViz: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS: <=11.03

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions IoTWorX: <=10.97.3

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions GENESIS32: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric Iconics Digital Solutions BizViz: vers:all/*

Product Status: known_affected

Remediations
Mitsubishi Electric GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric MC Works64: vers:all/*

Product Status: known_affected

Remediations

No fix planned
Mitsubishi Electric has no plans to release a fixed version of MC Works64. For customers using MC Works64, Mitsubishi Electric recommends taking the mitigations described in the Mitsubishi Electric's security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2026-006_en.pdf". Alternatively, customers should consider replacing MC Works64 with GENESIS64 or GENESIS. For information on how to replace it, please refer to the following document: "GENESIS64 ? How to Replace MC Works64 with GENESIS64" (Japanese only): "https://www.mitsubishielectric.co.jp/dl/fa/members/document/manual/scada/bcn-p5999-1459/bcnp59991459a.pdf". Note: This document is published on Mitsubishi Electric FA website, and membership registration and login are required to view it.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions GENESIS64: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions ICONICS Suite: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions Hyper Historian: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions AnalytiX: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Mitsubishi Electric Iconics Digital Solutions MobileHMI: <=10.97.3

Product Status: known_affected

Remediations

Vendor fix
Mitsubishi Electric Iconics Digital Solutions is releasing fixed version 10.98 or later for GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, and MobileHMI. Please download the fixed version from the link below and install it: "https://iconicsinc.my.site.com/community/s/resource-center/product-downloads". (Note: GENESIS64, Hyper Historian, AnalytiX, and MobileHMI are included in the ICONICS Suite installation.) For more information on the fixed version, please refer to the Mitsubishi Electric Iconics Digital Solutions whitepaper on security vulnerabilities, which can be found at "https://iconics.com/about/security/cert".

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend configuring the PCs with the affected product installed so that only an administrator can log in, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking remote login from untrusted networks and hosts, and from non-administrator users, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. and allowing remote login only to administrator when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend restricting physical access to the PC with the affected product installed and the network to which the PC is connected, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend preventing the user from clicking on web links in emails from untrusted sources, or from opening attachments in untrusted emails, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend using the PCs with the affected product installed in the LAN and blocking access from untrusted networks and hosts through firewalls, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend blocking unauthorized access by using a firewall, virtual private network (VPN), etc. when internet access is required, to minimize the risk of exploitation of this vulnerability.

Mitigation
For customers of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions recommend installing anti-virus software on the PC with the affected product installed, as well as on any PCs that can access it, to minimize the risk of exploitation of this vulnerability.

Additional Metrics

Relevant CWE: CWE-266 Incorrect Privilege Assignment

CVSS Version Base Score Base Severity Vector String
3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.0 9.4 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

View CVE Details

Acknowledgments

  • Mitsubishi Electric discovered these vulnerabilities.

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Mitsubishi Electric 2026-006 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Mitsubishi Electric directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-10-15
Date Revision Summary
2026-10-15 1 Initial Publication
2026-10-27 2 Initial CISA Republication of Mitsubishi Electric 2026-006 advisory
2026-10-29 3 Updating vendor and product name

Legal Notice and Terms of Use

EPICS Base

✇All CISA Advisories
By: CISA
27 October 2026 at 08:00

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.

The following versions of EPICS Base are affected:

  • EPICS Base release <=7.0.10 (CVE-2026-114595, CVE-2026-114596, CVE-2026-114597, CVE-2026-114598)
CVSS Vendor Equipment
v3 9.8 The EPICS Community EPICS Base release
3 Vulnerabilities
Integer Overflow or Wraparound, Improper Handling of Length Parameter Inconsistency, Access of Resource Using Incompatible Type ('Type Confusion')

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Global

Vulnerabilities

CVE-2026-114595
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

1 Affected Product

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-190 Integer Overflow or Wraparound

CVSS Version Base Score Base Severity Vector String
3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-114596
In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.

2 Affected Products

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-190 Integer Overflow or Wraparound

CVSS Version Base Score Base Severity Vector String
3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-114597
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

3 Affected Products

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-130 Improper Handling of Length Parameter Inconsistency

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

View CVE Details

CVE-2026-114598
In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

4 Affected Products

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

The EPICS Community EPICS Base release: <=7.0.10

Product Status: known_affected

Remediations

Mitigation
The EPICS Community has made available updates to the epics-base GitHub repositories. Affected users should update to the 7.0.11 release. For more information, users should contact the EPICS Controls team https://epics-controls.org/support/.

Mitigation
https://github.com/epics-base/epics-base/pull/934

Mitigation
https://github.com/epics-base/epics-base/pull/937

Mitigation
https://github.com/epics-base/pvDataCPP/pull/109

Additional Metrics

Relevant CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

View CVE Details

Acknowledgments

  • Shubham Raj of Cipher / Causal Security reported these vulnerabilities to CISA.

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Revision History

  • Initial Release Date: 2026-10-27
Date Revision Summary
2026-10-27 1 Initial Publication

Legal Notice and Terms of Use

CISA Adds Two Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
27 October 2026 at 08:00

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
  • CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. 

CISA Adds Two Known Exploited Vulnerabilities to Catalog

✇All CISA Advisories
By: CISA
26 October 2026 at 08:00

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching:  

These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. 

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. 

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. 

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISA Adds One Known Exploited Vulnerability to Catalog

✇All CISA Advisories
By: CISA
23 October 2026 at 08:00

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability 

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

CISA Adds One Known Exploited Vulnerability to Catalog

✇All CISA Advisories
By: CISA
23 October 2026 at 08:00

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

  • CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability

This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

Siemens SIMATIC S7 Webserver API

✇All CISA Advisories
By: CISA
22 October 2026 at 08:00

View CSAF

Summary

.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7 Webserver API and recommends to update to the latest version.

The following versions of Siemens SIMATIC S7 Webserver API are affected:

  • .NET Client Library for SIMATIC S7 Webserver API vers:intdot/<3.3.61, vers:intdot/<3.3.62 (CVE-2026-85114, CVE-2026-85115)
CVSS Vendor Equipment
v3 7.5 Siemens .NET Client Library for SIMATIC S7 Webserver API
2 Vulnerabilities
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Generation of Error Message Containing Sensitive Information

Background

  • Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Germany

Vulnerabilities

CVE-2026-85114
Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

1 Affected Product

.NET Client Library for SIMATIC S7 Webserver API < V3.3.61

Product Status: known_affected

Remediations

Vendor fix
Update to V3.3.61 or later version

Additional Metrics

Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS Version Base Score Base Severity Vector String
3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

View CVE Details

CVE-2026-85115
Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.

2 Affected Products

.NET Client Library for SIMATIC S7 Webserver API < V3.3.61

Product Status: known_affected

Remediations
.NET Client Library for SIMATIC S7 Webserver API < V3.3.62

Product Status: known_affected

Remediations

Vendor fix
Update to V3.3.62 or later version

Additional Metrics

Relevant CWE: CWE-209 Generation of Error Message Containing Sensitive Information

CVSS Version Base Score Base Severity Vector String
3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

View CVE Details

Acknowledgments

  • Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.

  • Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
  • Locate control system networks and remote devices behind firewalls and isolating them from business networks.
  • When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-390352 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

  • Initial Release Date: 2026-10-13
Date Revision Summary
2026-10-13 1 Publication Date
2026-10-22 2 Initial CISA Republication of Siemens ProductCERT SSA-390352 advisory

Legal Notice and Terms of Use

❌
❌