Answer in brief
CVE-2026-16438 records a Critical severity (CVSS 9.4) vulnerability in An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64. The current sources do not mark it as known exploited. The current feed maps Mitsubishi Electric Corporation/AnalytiX (generic), Mitsubishi Electric Iconics Digital Solutions/AnalytiX (generic), Mitsubishi Electric Corporation/GENESIS64 (generic), Mitsubishi Electric Iconics Digital Solutions/GENESIS64 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Mitsubishi Electric Corporation/AnalytiX (generic), Mitsubishi Electric Iconics Digital Solutions/AnalytiX (generic), Mitsubishi Electric Corporation/GENESIS64 (generic), Mitsubishi Electric Iconics Digital Solutions/GENESIS64 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Mitsubishi Electric Corporation/AnalytiXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/AnalytiXgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/GENESIS64generic | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/GENESIS64generic | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/Hyper Historiangeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/Hyper Historiangeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/ICONICS Suitegeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/ICONICS Suitegeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Corporation/MC Works64generic | all versions | Not reported |
| Mitsubishi Electric Corporation/MobileHMIgeneric | versions 10.97.3 and prior | Not reported |
| Mitsubishi Electric Iconics Digital Solutions/MobileHMIgeneric | versions 10.97.3 and prior | Not reported |
Published upstream
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, and MobileHMI 10.97.3 and prior allows an attacker who can log in using the same administrator account for the affected products to launch and operate DCOM objects locally or remotely. During installation, the installers of the affected products unnecessarily grant default DCOM permissions to the administrator account of the affected products. Users with that administrator accounts can locally or remotely launch and operate DCOM objects that should require UAC elevation. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.
Quoted source text, attributed separately from HOL analysis.