CISA Warns GENESIS and ICONICS Users: Version 10.97.3 Doesn't Fix All Vulnerabilities

On October 27, 2026, CISA published advisory ICSA-26-300-02 covering Mitsubishi Electric and ICONICS products. The JVN advisory listing confirms the release. Mitsubishi Electric had already disclosed the vulnerabilities on October 15. Picking the right update path matters: ICONICS Suite 10.97.3 does not fix every issue on the list.

Which products are affected

The advisory covers GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz. Which vulnerabilities apply depends on the product and version.

CVE-2023-4863 affects the libwebp component in GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2. It could allow code execution when a crafted file is processed. According to the vendor, exploitation requires a local login and product administrator privileges.

CVE-2026-16436 and CVE-2026-16437 affect the access recovery mechanism. The first could let anyone who knows the shared, fixed response used by the security mechanism unlock the system remotely. The second requires local access with administrator privileges and modifying the file that stores that response.

CVE-2026-16438 involves incorrectly assigned DCOM permissions. It could let a user with a product administrator account perform operations that require elevated privileges. If exploited, these vulnerabilities could lead to data disclosure, modification or deletion, as well as a system shutdown.

What to do now

According to the vendor’s advisory, the update has to match the specific vulnerability and product:

• For CVE-2023-4863 in GENESIS64 and ICONICS Suite, the fix is in ICONICS Suite 10.97.3 or later.
• For CVE-2026-16436, CVE-2026-16437 and CVE-2026-16438 in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX and MobileHMI, the vendor points to ICONICS Suite 10.98 or later.
• For CVE-2026-16436 and CVE-2026-16437, the fix is version 10.98 or later in IoTWorX and version 11.04 or later in GENESIS.
• The vendor does not plan to release fixes for MC Works64, GENESIS32 or BizViz. It recommends applying the mitigations described in the advisory and considering migration.

Before deploying, check the full version identifiers and confirm compatibility with your industrial installation. Until you can update, restrict access from untrusted networks, limit remote logins and control physical access to workstations. The vendor’s advisory describes additional steps for the access recovery mechanism.

SecurHUB’s take

In industrial environments, assessing a vulnerability requires knowing how the software connects to the production process. Cybersecurity audits help determine whether an attacker could reach these systems and set the order of remediation steps, agreed with the system owners.

Sources: Mitsubishi Electric — vendor advisory, JVN — CISA advisory listing