CVE-2026-16438: CWE-266 Incorrect Privilege Assignment in Mitsubishi Electric Corporation GENESIS64

This vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite 10.97.3 and prior, Hyper Historian 10.97.3 and prior, AnalytiX 10.97.3 and prior, MobileHMI 10.97.3 and prior, and all versions of MC Works64 is due to incorrect privilege assignment during installation. The installers grant default DCOM permissions to the administrator account, enabling users logged in with that account to launch and operate DCOM objects locally or remotely without UAC elevation. This improper permission setting can be exploited to disclose, tamper with, destroy, or delete internal information or cause denial-of-service on the affected systems.

An attacker with access to the administrator account can exploit this vulnerability to perform unauthorized actions on DCOM objects that should require elevated privileges. This can result in information disclosure, data tampering, destruction or deletion of data, and denial-of-service conditions on affected systems. The CVSS 4.0 score is 9.4 (critical), indicating a high impact with network attack vector, low attack complexity, and no user interaction required.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrator accounts and monitor for unauthorized use of DCOM objects. Avoid using shared administrator accounts where possible.