CVE-2026-16437: Mitsubishi GENESIS Auth Bypass Vulnerability

CVE-2026-16437 Overview

CVE-2026-16437 is a Weak Password Recovery Mechanism for Forgotten Password vulnerability [CWE-640] affecting Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz product families. An authenticated local user with administrative privileges can unlock the system by tampering with the management file that stores the challenge response. The management file is readable and writable by administrators but relies on Windows access control for protection. Successful exploitation enables disclosure, modification, destruction, or deletion of internal information, or can place the affected system into a denial-of-service (DoS) condition.

Critical Impact
An authenticated administrator can tamper with the challenge-response management file to unlock the system, compromising confidentiality, integrity, and availability across widely deployed Mitsubishi Electric and ICONICS industrial software.

Affected Products

Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior
Hyper Historian, AnalytiX, MobileHMI, and IoTWorX versions 10.97.3 and prior; MC Works64, GENESIS32, and BizViz all versions
Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX 10.97.3 and prior, GENESIS32 and BizViz all versions

Discovery Timeline

2026-10-15 - CVE-2026-16437 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-16437

Vulnerability Analysis

The vulnerability resides in the password recovery mechanism used by the affected ICONICS and Mitsubishi Electric products. These products store a challenge response in a management file on the local Windows host. The file is intended to be protected by Windows file system access controls rather than by cryptographic integrity verification inside the application. An attacker with administrative privileges on the host can read and modify this file. By tampering with the stored challenge response, the attacker can bypass the forgotten password recovery flow and unlock the system without supplying the legitimate credential.

The downstream impact is broad because the affected software spans supervisory control and data acquisition (SCADA) visualization, historian, analytics, and mobile HMI functions. Compromise of the recovery mechanism grants application-level control that can be used to disclose process data, alter configurations, or disrupt operations.

Root Cause

The root cause is reliance on operating system access control alone to protect a security-critical state file. The application does not cryptographically bind, sign, or validate the integrity of the challenge-response management file. Any user who already has administrator rights on the host inherits the ability to rewrite that file and defeat the recovery control.

Attack Vector

Exploitation requires local access and administrative privileges on the Windows host running the affected product. No user interaction is required. The attack is not remotely exploitable over the network. The attacker modifies the management file that stores the challenge response and then uses the forgotten-password flow to unlock the application.

No verified proof-of-concept code is available. See the Mitsubishi Electric Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-16437

Indicators of Compromise

Unexpected modification timestamps, size changes, or file hash drift on the ICONICS/GENESIS management file that stores the challenge response.
Successful forgotten-password unlock events on GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, or IoTWorX that do not correlate with a sanctioned administrator reset.
Windows Security event log entries showing administrator write access to the application's configuration directories outside of maintenance windows.

Detection Strategies

Enable file integrity monitoring (FIM) on the installation directories of the affected ICONICS and Mitsubishi Electric products, with specific coverage of the challenge-response management file.
Correlate local administrator logons (Windows Event IDs 4624 type 2/10 with privileged group membership) with subsequent application unlock or configuration events.
Alert on process access to the management file by anything other than the vendor's trusted service binaries.

Monitoring Recommendations

Forward Windows Security, Sysmon FileCreate/FileWrite, and ICONICS application audit logs to a centralized analytics platform for correlation.
Baseline the normal set of users and processes that touch the management file and alert on deviations.
Review privileged account inventories regularly and reduce the number of local administrators on engineering workstations and HMI hosts.

How to Mitigate CVE-2026-16437

Immediate Actions Required

Restrict local administrator rights on all hosts running affected GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz, or MC Works64 installations.
Enforce multi-factor authentication for interactive logons to engineering workstations and HMI servers.
Enable file integrity monitoring on the challenge-response management file and application configuration directories.
Review and audit historical use of the forgotten-password recovery flow across affected systems.

Patch Information

Consult the Mitsubishi Electric Security Advisory for the authoritative list of fixed versions and vendor remediation guidance. Operators should upgrade GENESIS to a release above 11.03 and GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and IoTWorX beyond 10.97.3 once the vendor-specified fixed builds are published. MC Works64, GENESIS32, and BizViz have no listed fixed version; apply the compensating controls below.

Workarounds

Minimize the number of accounts with Windows administrator privileges on hosts running the affected software, following least-privilege principles.
Segment HMI, historian, and SCADA hosts on isolated OT networks and block inbound access from corporate or untrusted zones.
Monitor and alert on any modification of the challenge-response management file using host-based FIM or endpoint detection tooling.
Physically secure engineering workstations and enforce session lockout and screen-lock policies to reduce opportunity for local tampering.

bash

# Example: enable Windows auditing on the ICONICS management file directory
# Replace <PATH> with the vendor-documented management file location
auditpol /set /subcategory:"File System" /success:enable /failure:enable
icacls "<PATH>" /setaudit "Everyone:(OI)(CI)(F)"