# CISA Advisory: Mitsubishi ICONICS Suite Flaws

Published: 2026-10-27 · Severity: high · Sectors: Manufacturing, Energy, Infrastructure
Canonical: https://vorant.io/reports/d7d3dcbf-c1b6-561c-961d-2a82786bb41e/cisa-advisory-mitsubishi-iconics-suite-flaws

> CISA details four vulnerabilities in Mitsubishi Electric's ICONICS-based SCADA/HMI product line enabling code execution, auth bypass, and DoS; patches available.

CISA published an ICS advisory covering Mitsubishi Electric's GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz products, widely used in critical manufacturing and other industrial environments. Four vulnerabilities are addressed: CVE-2023-4863 (a known libwebp heap buffer overflow affecting GENESIS64/ICONICS Suite versions 10.97-10.97.2, enabling arbitrary code execution), CVE-2026-16436 and CVE-2026-16437 (authentication bypass issues affecting most of the product line up to various versions), and CVE-2026-16438 (allows arbitrary operations, affecting a subset of products). Successful exploitation could result in information disclosure, data tampering/destruction, or denial-of-service conditions on affected HMI/SCADA systems.

Mitsubishi Electric has released fixed versions (10.97.3, 11.04, and 10.98 depending on the product) and published its own security advisory. For products without an immediate fix path, the vendor recommends restricting administrator-only login, isolating affected PCs to LAN with blocked remote access from untrusted networks, firewall/VPN controls, physical access restrictions, anti-phishing user training, antivirus deployment, and a specific manual mitigation involving deletion and permission-locking of a ClientChallengeTable.dat/SecurityChallenges.dat file used in the authentication challenge mechanism. No in-the-wild exploitation of the 2026 CVEs is indicated in the advisory; CVE-2023-4863 is a previously disclosed and widely exploited libwebp flaw.

Defenders running any of the listed Mitsubishi Electric/ICONICS products should prioritize patching to the fixed versions, apply the vendor's compensating controls where patching is delayed, and verify the described .dat file mitigation is correctly implemented. These are legacy-style SCADA/HMI products found in critical manufacturing environments, where unpatched instances could persist for extended periods.

## Mentioned in this report

- Vulnerabilities: CVE-2023-4863 (KEV), CVE-2026-16436, CVE-2026-16437, CVE-2026-16438

## Detection guidance (public sample)

### ICONICS Authentication Challenge File Created or Modified

ATT&CK: T1556

Detects creation or modification of ClientChallengeTable.dat or SecurityChallenges.dat, the ICONICS/Mitsubishi authentication challenge files, which could indicate tampering with the auth mechanism or reversal of the vendor mitigation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ICONICS Authentication Challenge File Created or Modified
description: Detects file creation or modification of ClientChallengeTable.dat or
  SecurityChallenges.dat, the files used by the ICONICS/Mitsubishi authentication
  challenge mechanism. Writes outside of product install or patching can indicate
  tampering with authentication or undoing the vendor's permission-locking mitigation.
  The rule is based on the vendor mitigation guidance, not on observed exploitation.
tags:
- attack.credential-access
- attack.defense-impairment
- attack.t1556
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
    - \ClientChallengeTable.dat
    - \SecurityChallenges.dat
  filter_installer:
    Image|endswith:
    - \msiexec.exe
    - \setup.exe
  condition: selection and not filter_installer
falsepositives:
- Administrators re-creating or replacing the challenge files while applying the vendor
  mitigation
- Product upgrades or repairs that regenerate the files
level: medium
id: b7068d3e-cb66-5f6b-bb46-81e290ae8c87
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-300-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d7d3dcbf-c1b6-561c-961d-2a82786bb41e/cisa-advisory-mitsubishi-iconics-suite-flaws.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup