CISA Advisory: Mitsubishi ICONICS Suite Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CISA details four vulnerabilities in Mitsubishi Electric's ICONICS-based SCADA/HMI product line enabling code execution, auth bypass, and DoS; patches available.
CISA published an ICS advisory covering Mitsubishi Electric's GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz products, widely used in critical manufacturing and other industrial environments. Four vulnerabilities are addressed: CVE-2023-4863 (a known libwebp heap buffer overflow affecting GENESIS64/ICONICS Suite versions 10.97-10.97.2, enabling arbitrary code execution), CVE-2026-16436 and CVE-2026-16437 (authentication bypass issues affecting most of the product line up to various versions), and CVE-2026-16438 (allows arbitrary operations, affecting a subset of products). Successful exploitation could result in information disclosure, data tampering/destruction, or denial-of-service conditions on affected HMI/SCADA systems.
Mitsubishi Electric has released fixed versions (10.97.3, 11.04, and 10.98 depending on the product) and published its own security advisory. For products without an immediate fix path, the vendor recommends restricting administrator-only login, isolating affected PCs to LAN with blocked remote access from untrusted networks, firewall/VPN controls, physical access restrictions, anti-phishing user training, antivirus deployment, and a specific manual mitigation involving deletion and permission-locking of a ClientChallengeTable.dat/SecurityChallenges.dat file used in the authentication challenge mechanism. No in-the-wild exploitation of the 2026 CVEs is indicated in the advisory; CVE-2023-4863 is a previously disclosed and widely exploited libwebp flaw.
Defenders running any of the listed Mitsubishi Electric/ICONICS products should prioritize patching to the fixed versions, apply the vendor's compensating controls where patching is delayed, and verify the described .dat file mitigation is correctly implemented. These are legacy-style SCADA/HMI products found in critical manufacturing environments, where unpatched instances could persist for extended periods.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,337 reports from 144 sources, 610 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs