Mitsubishi Electric GENESIS64 CVE-2026-16438

The attacker must be able to authenticate using the administrator account of the affected products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64). During installation the product installers unnecessarily grant default DCOM launch/activation permissions to that product administrator account; this lets any holder of that administrator account launch and operate - locally or remotely - DCOM objects that should otherwise require UAC elevation. The principal limiting factor is therefore PR:H: exploitation is not possible for unauthenticated users or for users without the product's administrator account, which constrains realistic risk to insiders, credential-theft scenarios, or compromised admin sessions despite the network-reachable AV:N vector. MC Works64 is affected in all versions; the other products are affected at 10.97.3 and prior.

This is a genuine high-severity privilege-management flaw (CWE-266) but one whose real-world risk is gated by a meaningful precondition rather than by mass exploitability. The vendor-supplied CVSS 4.0 vector (9.4) marks AV:N/AC:L/AT:N/UI:N with full high impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), which drives the critical score. However, PR:H is the decisive signal: exploitation requires the attacker to already be able to log in using the administrator account of the affected ICONICS/GENESIS64 products, so this is a privilege-boundary/UAC-bypass issue for an already-privileged operator account, not an unauthenticated remote takeover. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the high CVSS reflects impact and the network-reachability of DCOM rather than demonstrated or likely widespread attack activity. Net: a real priority for OT/ICS asset owners running these HMI/SCADA products (because the impact is total and DCOM can be driven remotely), but the PR:H requirement and the absence of KEV/EPSS/POC signals indicate targeted/insider-adjacent risk rather than opportunistic mass exploitation.

An attacker who has obtained or already holds the product administrator account credentials for an ICONICS/GENESIS64 deployment logs in and, because the installer over-granted default DCOM launch/activation permissions to that account, invokes DCOM objects locally or over the network that should otherwise require UAC elevation. Using those objects the attacker reads or alters internal process data, destroys configuration, or forces the HMI/SCADA system into a denial-of-service state. No public exploit code is identified at time of analysis, and the attack factors in the vendor's AV:N/AC:L assessment (remotely reachable DCOM, low attack complexity) offset by the required administrator login (PR:H).