Answer in brief
CVE-2026-16437 records a High severity (CVSS 7.1) vulnerability in An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. The current sources do not mark it as known exploited. The current feed maps Mitsubishi Electric Corporation/AnalytiX (generic), Mitsubishi Electric Iconics Digital Solutions/AnalytiX (generic), Mitsubishi Electric Corporation/BizViz (generic), Mitsubishi Electric Iconics Digital Solutions/BizViz (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Mitsubishi Electric Corporation/AnalytiX (generic), Mitsubishi Electric Iconics Digital Solutions/AnalytiX (generic), Mitsubishi Electric Corporation/BizViz (generic), Mitsubishi Electric Iconics Digital Solutions/BizViz (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Mitsubishi Electric Corporation/AnalytiXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/AnalytiXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/BizVizgeneric | all versions | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/BizVizgeneric | all versions | Not reported |
| Mitsubishi Electric Corporation/GENESISgeneric | versions 11.03 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/GENESISgeneric | versions 11.03 and prior | Not reported |
| Mitsubishi Electric Corporation/GENESIS32generic | all versions | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/GENESIS32generic | all versions | Not reported |
| Mitsubishi Electric Corporation/GENESIS64generic | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/GENESIS64generic | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/Hyper Historiangeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/Hyper Historiangeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/ICONICS Suitegeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/ICONICS Suitegeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/IoTWorXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/IoTWorXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/MC Works64generic | all versions | Not reported |
| Mitsubishi Electric Corporation/MobileHMIgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/MobileHMIgeneric | versions 10.97.3 and prior | Not reported |
Published upstream
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Quoted source text, attributed separately from HOL analysis.