← Back to Vulnerability Reports CVE Intelligence

CVE-2026-16436

See advisory•CRITICAL · CVSS 9.2•No exploitation reported

What is CVE-2026-16436?

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows a remote attacker to unlock the system by obtaining the challenge response by some means. The challenge response used to unlock the system is common to all users and fixed. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition.

CVSS9.2 NVD 4.0

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P25

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWECWE-640

NVD published2026-10-15

NVD last modified2026-10-16

Timeline

2026-10-15Published to the U.S. National Vulnerability Database (NVD)
2026-10-16NVD record last updated

Affected product

See advisory

Remediation Steps

Identify and inventory all Mitsubishi Electric products in the affected suite deployed in your environment
Obtain vendor security advisories and patches from Mitsubishi Electric official channels
Disable default credentials and enforce strong authentication policies
Test patches in non-production ICS environment before deployment
Apply patches according to maintenance windows and operational requirements

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 4 of October 2026 (October 26 – November 1)

Related vulnerabilities

CVE-2026-18963 (same weakness: CWE-640)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.